search

HTB | Puppy

This is a Windows box. You can find it herearrow-up-right

IP - 10.10.11.70

MACHINE INFORMATION - As is common in real life pentests, you will start the Puppy box with credentials for the following account: levi.james / KingofAkron2025!

hashtag
Nmap

└─$ nmap -sT -p- --min-rate 10000 10.10.11.70 -Pn -oA nmap_ports                                                                                      
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-05-18 11:40 IST
Nmap scan report for 10.10.11.70
Host is up (0.25s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
111/tcp   open  rpcbind
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
2049/tcp  open  nfs
3260/tcp  open  iscsi
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49664/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown
55152/tcp open  unknown
55178/tcp open  unknown
55214/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 38.32 seconds

hashtag
LDAP

From the above, we can confirm the DC name puppy.htb

Since we have credentials , we can use LDAP query

Now we can copy the list of users

Let’s use netexe to see if anyone is using levi’s password

So no one is using Levi’s password

hashtag
Bloodhound

Since we have the credentials for the user, Let's use bloodhound-python for further enumeration

hashtag
Foothold/ shell

hashtag
shell as adma.silver

hashtag
GenericWrite

On analyzing bloodhound i can see LEVI.JAMES@PUPPY.HTB → MemberOf → HR@PUPPY.HTB → GenericWrite → DEVELOPERS@PUPPY.HTB We can exploit this to escalate privileges by adding Levi to the DEVELOPERS@puppy.htb group using the GenericWrite permission.

I have added levi to developers group

now levi have read access to DEV share

hashtag
keepass DB

Now we can list directory in DEV

We found krecovery.kdbx

Let’s download the file

Since this version of keepass is not supported by johntheripper we will use keepass4brutearrow-up-right

We have found the password

Let’s sue this password to open the recovery.kbdx

and we now have the clear text password for adam , anthony, jamie, samuel, steve

samuel and steve was not found earlier so i will add them in our user list

We will use kerbrute to check the valid username and password

and we got the hit for ant.edwards

hashtag
GenericAll

On analyzing bloodhound i can see ANT.EDWARDS@PUPPY.HTB → MemberOf → SENIOR DEVS@PUPPY.HTB → GenericAll → ADAM.SILVER@PUPPY.HTB

This is also known as full control. This privilege allows the trustee to manipulate the target object however they wish.

So we can change USER LOCKED OUT to unlock for the user adman.silver

We will use bloodAD for this

Since adam user was disable we need to reassign the password

Now we can login

Now its time to login

found user.txt

hashtag
Privilege Escalation

hashtag
Shell as Steph.cooper

hashtag
Backup folder

found Backup folder in C:\\

found site-backup-2024-12-30.zip , let’s download it and unzip

found nms-auth-config.xml.bak in which we found cred for steph.cooper

and we are in as steph.cooper

hashtag
Shell as steph.cooper_adm

hashtag
Saved credential - DPAI

We can see Microsoft Edge.lnk on the Desktop

Which would indicate usage of Microsoft Edge with a potentially saved password.

The system level cred are stored by DPAPI here

the master key for these are stored here

hashtag
Decrypt Credential — Decrypt Master Key

There are two method

  • via mimikatz

  • via impacket-dpapi

Via Mimikatz

The challenge is that the master key is encrypted with the user’s password, and I don’t have it. Fortunately, there’s a blog postarrow-up-right from SpecterOps that shows how to decrypt without the password, using an RPC called MS-BKRP (BackupKey Remote Protocol). To abuse this I’ll use the /rpc flag in Mimikatz.

Let's upload mimikatz to the box

Now we have to get the key

we have the key at the end. Now Let's try this key on the credential

Now we have the credential for steph.cooper_adm

Via impacket-dpapi

We will convert the credential file into base64 so that we can transfer it to our machine (or we can simply download the file since we have evil-winrm)

Decode it and write it on our machine.

We will transfer the master key in similar manner

Now let’s use impacket-dapi to get the key

Now let’s use this key to get the credential

Since we have credentials of steph.cooper_adm we can login

and we got root.txt

PreviousHTB | TheFrizzNextHTB | Fluffy

Last updated