search

HTB | Delegate

Machine - https://app.hackthebox.com/machines/Delegatearrow-up-right

IP - 10.129.24.164

hashtag
NMAP

admin@ip-172-31-25-116:~/delegate/nmap$ nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,47001,49664,49665,49666,49667,49669,49670,64167,64169,64173,64186,6419 10.129.24.164 -Pn -oA nmap_ports_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2026-01-07 05:49 UTC
Nmap scan report for ip-10-129-24-164.ap-south-1.compute.internal (10.129.24.164)
Host is up (0.20s latency).

PORT      STATE    SERVICE       VERSION
53/tcp    open     domain        Simple DNS Plus
88/tcp    open     kerberos-sec  Microsoft Windows Kerberos (server time: 2026-01-07 05:49:46Z)
135/tcp   open     msrpc         Microsoft Windows RPC
139/tcp   open     netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open     ldap          Microsoft Windows Active Directory LDAP (Domain: delegate.vl0., Site: Default-First-Site-Name)
445/tcp   open     microsoft-ds?
464/tcp   open     kpasswd5?
593/tcp   open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open     tcpwrapped
3268/tcp  open     ldap          Microsoft Windows Active Directory LDAP (Domain: delegate.vl0., Site: Default-First-Site-Name)
3269/tcp  open     tcpwrapped
3389/tcp  open     ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC1.delegate.vl
| Not valid before: 2026-01-06T05:46:30
|_Not valid after:  2026-07-08T05:46:30
|_ssl-date: 2026-01-07T05:51:23+00:00; +4s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: DELEGATE
|   NetBIOS_Domain_Name: DELEGATE
|   NetBIOS_Computer_Name: DC1
|   DNS_Domain_Name: delegate.vl
|   DNS_Computer_Name: DC1.delegate.vl
|   DNS_Tree_Name: delegate.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2026-01-07T05:50:43+00:00
5985/tcp  open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
6419/tcp  filtered svdrp
9389/tcp  open     mc-nmf        .NET Message Framing
47001/tcp open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open     msrpc         Microsoft Windows RPC
49665/tcp open     msrpc         Microsoft Windows RPC
49666/tcp open     msrpc         Microsoft Windows RPC
49667/tcp open     msrpc         Microsoft Windows RPC
49669/tcp open     msrpc         Microsoft Windows RPC
49670/tcp open     msrpc         Microsoft Windows RPC
64167/tcp open     ncacn_http    Microsoft Windows RPC over HTTP 1.0
64169/tcp open     msrpc         Microsoft Windows RPC
64173/tcp open     msrpc         Microsoft Windows RPC
64186/tcp open     msrpc         Microsoft Windows RPC
Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-01-07T05:50:44
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 3s, deviation: 0s, median: 3s

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 111.89 seconds

hashtag
SMB

Anonymous login is allowed

Let’s try to brute rid

Now we have username list

We found users.bat file in SYSVOL

found the credentials of A.Briggs

we can use this credentials for LDAP and SMB Authentication

Windows defender is installed

it is vulnerable to DFSCoerce

hashtag
Shell/ Foothold

hashtag
Shell as N.Thompson

hashtag
GenericWrite

A.Briggs have GenericWrite over N.Thompson

And N.Thompson is a part of Remote Management Users

Let’s use Targeted Kerberos, and for that I will be using [targetedKerberoast.pyarrow-up-right](http://targetedKerberoast.pyhttpsarrow-up-right://github.com/ShutdownRepo/targetedKerberoast)

Let’s try to crack via hashcat

and we can winrm

we are in and got user.txt

hashtag
Priv Esc

hashtag
Shell as Administrator

hashtag
SeEnableDelegationPrivilege

we can see that we have SeEnableDelegationPrivilege

This means that we can abuse unconstrained delegation by creating a machine account and appending a SPN to it, but first, let’s check the machine quota

Now I will create a machine account

adding DNS record for the machine account we created

Now let’s add SPN to it

Now I’ll give the host unconstrained delegation using BloodyAD

Relay

Let’s set up krbrelayx but first I need to convert my crated computer password to NTLM hash

Now we need to coerce the DC to authenticating to anurag.delegate.vl, first let’s test via netexec

We will use PrinterBug

And on listner we got the TGT for DC1$@DELEGATE.VL_krbtgt@DELEGATE.VL.ccache

hashtag
DCSYNC

With the TGT we can perform DCSYNC, but first let’s generate krb5.conf file and authenticate as the machine account

Now I will use netexe to dump the hashes

and with that we can get the shell

PreviousHTB | MirageNextHTB | Atlas

Last updated