HTB | Baby

Machine - https://app.hackthebox.com/machines/Baby

IP - 10.129.60.223

NMAP

nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,49664,49669,51495,51496,51505,61220 10.129.60.223 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-10-16 06:10 UTC
Nmap scan report for ip-10-129-60-223.ap-south-1.compute.internal (10.129.60.223)
Host is up (0.12s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-10-16 06:11:00Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: baby.vl0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: baby.vl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=BabyDC.baby.vl
| Not valid before: 2025-08-18T12:14:43
|_Not valid after:  2026-02-17T12:14:43
|_ssl-date: 2025-10-16T06:12:30+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: BABY
|   NetBIOS_Domain_Name: BABY
|   NetBIOS_Computer_Name: BABYDC
|   DNS_Domain_Name: baby.vl
|   DNS_Computer_Name: BabyDC.baby.vl
|   DNS_Tree_Name: baby.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2025-10-16T06:11:50+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
51495/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
51496/tcp open  msrpc         Microsoft Windows RPC
51505/tcp open  msrpc         Microsoft Windows RPC
61220/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: BABYDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-10-16T06:11:53
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 102.16 seconds

SMB

null authentication is there but we cannot enum shares

LDAP

we can get the user list via nxc

Let’s combine both

Foothold/shell

Shell as Caroline.Robinson

From the description we got the credential Teresa.Bell

Looks like it is not working for Teresa, let’s do passwordspray

SMB passwordspray fails but for Caroline gives STATUS_PASSWORD_MUST_CHANGE, let’s try for LDAP

same error for Caroline STATUS_PASSWORD_MUST_CHANGE let’s change the password

and we can authenticate

we can get the shares and we have READ, WRITE on C$

let’s winrm to the server

and we are in

found user.txt

Priveleage Esclation

Shell as ?

SeBackupPrivilege

We are in the backup operator group and have SeBackupPrivilege

This repo has a nice set of PowerShell tools for abusing the SeBackupPrivilege

Let’s download and import them into my current session:

Now I can copy root.txt

PreviousHTB | CertifiedNextHTB | Breach

Last updated