search

HTB | Vintage

Machine - https://app.hackthebox.com/machines/Vintagearrow-up-right

IP - 10.10.11.45

Machine Information - As is common in real life Windows pentests, you will start the Vintage box with credentials for the following account: P.Rosa / Rosaisbest123

hashtag
NMAP

└─$ nmap -sT -p- --min-rate 10000 10.10.11.45 -Pn -oA nmap_ports                                                                                                              
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-07-25 19:08 IST
Nmap scan report for 10.10.11.45
Host is up (0.85s latency).
Not shown: 65516 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49664/tcp open  unknown
49668/tcp open  unknown
49674/tcp open  unknown
49685/tcp open  unknown
56155/tcp open  unknown
56230/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 273.80 seconds

hashtag
SMB

(NTLM:False) shows that NTLM auth is disabled. I’ll try with Kerberos and it works:

enum shares

We can also get the users list

hashtag
Bloodhound

Interestingly there are two computers

hashtag
Foothold/ Shell

hashtag
Shell as C.Neri

hashtag
Weak Permission Pre2K

On looking at FS01$ we found that FS01.VINTAGE@HTB -> MemberOf -> PRE-WINDOWS 2000 COMPATIBLE ACCESS@VINTAGE.HTB

When a new computer account is configured as "pre-Windows 2000 computer", its password is set based on its name (i.e. lowercase computer name without the trailing $). When it isn't, the password is randomly generated.

Let’s try to authenticate via fs01 as password

bingo!!! It worked

hashtag
Auth as GMSA01$

FS01.VINTAGE@HTB -> MemberOf -> DOMAIN COMPUTERS@VINTAGE.HTB -> ReadGMSAPassword -> GMSA01$@VINTAGE.HTB

Let’s msDS-ManagedPassword of GMSA01$

Let’s try to authenticate

hashtag
GenericWrite / AddSelf

GMSA01$@VINTAGE.HTB -> GenericWrite/ AddSelf -> SERVICEMANAGERS@VINTAGE.HTB

Let’s GMSA01$@VINTAGE.HTB to SERVICEMANAGERS group

hashtag
GenericAll

SERVICEMANAGERS@VINTAGE.HTB -> GenericAll -> SVC_ARK@VINTAGE.HTB / SVC_LDAP@VINTAGE.HTB / SVC_SQL@VINTAGE.HTB

hashtag
Targeted Kerberoasting on SVC_SQL

We can try Targeted Kerberoasting on SVC_*, but first, we need to enable SVC_SQL@VINTAGE.HTB

remember to get a new TGT for GSMA01$

for targeted Kerberoasting, I need to set SPN

Now let’s perform Taregeted Kerberoasting

hashtag
Crack the Hash

Let’s try to crack the hash

found sql_svc password

hashtag
passwordspray

Let’s password spray the password of svc_sql for users we got earlier

We are in as C.Neri and got user.txt

hashtag
Privilege Escalation

hashtag
Shell as L.Bianchi_adm

hashtag
DAPI

My first thought is to use RunasCs.exearrow-up-right to get an interactive logon, but it fails even with the PowerShell script due to AV

Now I will try to get the key and credentials offline and try to decrypt

I’ll need the master key, information about the account, and the encrypted credential. The master key is helped in AppData\\Roaming\\Microsoft\\Protect\\[sid]:

There’s two files there that could be the master key. Trying to download either with Evil-WinRM fails:

I’ll just base64-encode them:

I’ll do the same with the credential file:

For each of these three, I’ll paste the base64, decode it, and save it as a file on my host.

the second key worked

Let’s try to authenticate c.neri_adm

hashtag
RBCD

C.NERI_ADM@VINTAGE.HTB -> MemberOf -> DELEGATEDADMINS@VINTAGE.HTB -> AllowedToAct -> DC01.VINTAGE.HTB

To pull of this attack, I’ll need a compromised account with a service principal name (SPN). C.Neri_adm does not have one, and I don’t have permissions to add one. But, FS01$ does, and C.Neri_adm has GenericWrite over DelegatedAdmins, which means they can add accounts to the group. From there, I can have the FS01$ account request a ticket on behalf of any account. There are many ways to exploit this. I’ll get a CIFS ticket as the DC01$ computer account and use that to dump the hashes for the domain.

Add FS01$ to DelegatedAdmins

Get DC01$ ST

I’ll make a new ticket as FS01$: (on new terminal)

Now we can DCSYNC

Now we can auth as adminsitrator

It fails. That’s because the Administrator account is restricted from logging in. I can see this with netexec:

The Domain Admins group has two users in it:

I’ll try the same thing with L.Bianchi_adm:

we are in

and we found root.txt

PreviousHTB | TombWatcherNextHTB | Manager

Last updated