search

HTB | Voleur

Machine -https://app.hackthebox.com/machines/Voleurarrow-up-right

Machine Information - As is common in real life Windows pentests, you will start the Voleur box with credentials for the following account: ryan.naylor / HollowOct31Nyt

hashtag
NMAP

└─$ nmap -sC -sV -p 53,88,135,139,389,445,593,636,2222,3268,3269,5985,9389,49664,49668,49670,49671,50282,50301,64956 10.129.101.152 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-07-06 18:14 IST
Nmap scan report for 10.129.101.152
Host is up (0.82s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-06 20:45:07Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
2222/tcp  open  ssh           OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
|_  256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         Microsoft Windows RPC
50282/tcp open  msrpc         Microsoft Windows RPC
50301/tcp open  msrpc         Microsoft Windows RPC
64956/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel

Host script results:
| smb2-time: 
|   date: 2025-07-06T20:46:09
|_  start_date: N/A
|_clock-skew: 8h00m03s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 132.52 seconds

Interesting SSH at port 2222 in a Windows box (probably WSL?)

hashtag
Port 53

hashtag
SMB

We need TGT

Let’s enum shares

Smbclient was giving an error, so we will use Impacket

found excel file

It is password proctected

We will use john to crack the password

We now have cred for svc_ldap and svc_iis

hashtag
Bloodhound

users

From Bloodhound

REMOTE MANAGEMENT USERS contains SVC_WINRM and JEREMY.COMBS

SVC_LDAP - > WriteSPN - > SVC_WINRM

hashtag
Foothold/ Shell

hashtag
Shell as svc_winrm

hashtag
WriteSPN

Since SVC_LDAP - > WriteSPN - > SVC_WINRM and we have SVC_LDAP password

We can use targetedKerberoastarrow-up-right

hashtag
Crack the svc_winrm TGS-REP hash

we will use hashcat for cracking

and we get that password for svc_winrm

we can get the shell but first let’s forge TGT for svc_winrm

and we have user.txt

hashtag
Privilege Escalation

hashtag
Shell as Administrator

hashtag
Restoring todd.wolfe

Since svc_ldap is a MemberOf RESTORE_USERS and from the excel we know there is a deleted user

First Let’s try to get shell as svc_ldap

PSSession did not worked

Now there are two ways, first is to use RunasC and get access as svc_ldap and then check for deleted objects and restore and the second is via bloodyad. We will be using bloodyad (refer to rustykeyarrow-up-right for login as RunAsC and Tombwatcherarrow-up-right for AD cmd)

We can now search for deleted objects from the svc_ldap creds:

We need to check the security descriptors of Todd Wolfe tombstone to learn if svc_ldap has write access over the necessary attributes:

Now we can restore the object

From the excel we have the cred of todd

hashtag
SMB as todd

todd.wolfe is a member of the groups Remote Management Users and Second-Line Technicians.

not able to login, but got smb access

we found that we have access to home directory backup of todd.wolfe

hashtag
Parsing DPAPI from user's home directory to get jeremy.combs

Since we find nothing but in AppData, we might find DPAPI related files. And as we know this user's password, we'll be able to extract the masterkey and decipher his stored credentials.

DPAPI masterkeys are generally stored in the following directories:

  • %HOME%\AppData\Roaming\Microsoft\Protect\<UserSID>\

  • %HOME%\AppData\Local\Microsoft\Protect\<UserSID>\

Here, we find one:

  • %HOME%\AppData\Roaming\Microsoft\Protect\S-1-5-21-3927696377-1337352550-2781715495-1110\08949382-134f-4c63-b93c-ce52efc0aa88

Once we have the masterkey file, we need the encrypted blobs, generally found in the following directories:

  • %HOME%\AppData\Roaming\Microsoft\Credentials\

  • %HOME%\AppData\Local\Microsoft\Credentials\

Here, we find one:

  • %HOME%\AppData\Roaming\Microsoft\Credentials\772275FAD58525253490A9B0039791D3

After downloading these files, we can use impacket's dpapi.pyarrow-up-right to decrypt the masterkey and decrypt the blob:

hashtag
SMB via jeremy.combs

We remember from our initial enumeration that jeremy.combs is in the Third-Line Technicians group.

We remember from our initial enumeration that jeremy.combs is in the Third-Line Technicians group.

The Note confirms the probable use of WSL (port 2222).

hashtag
SHH as svc_backup

hashtag
Finding NTDS.dit backup, parsing it and getting root

In these configurations, the windows drives are mounted in /mnt.

Visting the IT folder, we find a backup of the NTDS.dit and registries (the exact output of an ntdsutil.exe backup).

Let’s copy all the files and perform secretsdump

we got the Administrator hash now we can get the shell

and we got the root.txt

PreviousHTB | RustyKeyNextHTB | Mirage

Last updated