search

HTB | Baby

Machine - https://app.hackthebox.com/machines/Babyarrow-up-right

IP - 10.129.60.223

hashtag
NMAP

nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,49664,49669,51495,51496,51505,61220 10.129.60.223 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-10-16 06:10 UTC
Nmap scan report for ip-10-129-60-223.ap-south-1.compute.internal (10.129.60.223)
Host is up (0.12s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-10-16 06:11:00Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: baby.vl0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: baby.vl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=BabyDC.baby.vl
| Not valid before: 2025-08-18T12:14:43
|_Not valid after:  2026-02-17T12:14:43
|_ssl-date: 2025-10-16T06:12:30+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: BABY
|   NetBIOS_Domain_Name: BABY
|   NetBIOS_Computer_Name: BABYDC
|   DNS_Domain_Name: baby.vl
|   DNS_Computer_Name: BabyDC.baby.vl
|   DNS_Tree_Name: baby.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2025-10-16T06:11:50+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
51495/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
51496/tcp open  msrpc         Microsoft Windows RPC
51505/tcp open  msrpc         Microsoft Windows RPC
61220/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: BABYDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-10-16T06:11:53
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 102.16 seconds

hashtag
SMB

null authentication is there but we cannot enum shares

hashtag
LDAP

we can get the user list via nxc

Let’s combine both

hashtag
Foothold/shell

hashtag
Shell as Caroline.Robinson

From the description we got the credential Teresa.Bell

Looks like it is not working for Teresa, let’s do passwordspray

SMB passwordspray fails but for Caroline gives STATUS_PASSWORD_MUST_CHANGE, let’s try for LDAP

same error for Caroline STATUS_PASSWORD_MUST_CHANGE let’s change the password

and we can authenticate

we can get the shares and we have READ, WRITE on C$

let’s winrm to the server

and we are in

found user.txt

hashtag
Priveleage Esclation

hashtag
Shell as ?

hashtag
SeBackupPrivilege

We are in the backup operator group and have SeBackupPrivilege

This repoarrow-up-right has a nice set of PowerShell tools for abusing the SeBackupPrivilege

Let’s download and import them into my current session:

Now I can copy root.txt

PreviousHTB | CertifiedNextHTB | Breach

Last updated