Administrator — HTB Writeup

Executive summary — Administrator is an assumed breach scenario: a low-privilege domain credential is handed over and the goal is to escalate to Domain Admin. There isn't a single CVE anywhere in the chain — the entire compromise rests on badly delegated Active Directory permissions chained together, plus a backup file that never should have lived on an FTP service running on the domain controller itself. That's exactly what makes it representative of a real corporate AD: the attack path isn't opened by a missing patch, but by the historical buildup of delegations nobody ever audited as a graph.

Platform	Hack The Box
Operating system	Windows Server 2022
Difficulty	Medium
Status	Retired
Target IP	`10.129.59.211`

Attack map

[HANDED OVER]  olivia : ichliebedich   (assumed breach)
   │  ACE  GenericAll  over the user object michael
   ▼
[ACE #1]  michael           ◄── bloodyAD set password
   │  ACE  ForceChangePassword  over the user object benjamin
   ▼
[ACE #2]  benjamin          ◄── sole member of "Share Moderators"
   │  21/FTP → reachable home dir → Backup.psafe3 (952 bytes)
   ▼
[Password Safe V3]  pwsafe2john + rockyou → master "tekieromucho"
   │  Twofish-CBC → alexander✗ (disabled) · emma✗ (disabled) · emily✓
   ▼
[emily]  Remote Management Users → WinRM  (user.txt)
   │  ACE  GenericWrite  over ethan → fake SPN planted
   ▼
[Targeted Kerberoasting]  ethan's TGS cracked → "limpbizkit"
   │  ACE  GetChanges + GetChangesAll  over the DOMAIN object
   ▼
[DCSync]  Administrator's NT hash: 3dc553ce4b9fd20bd016e098d2d2fd2e
   │  Pass-the-Hash → WinRM 5985
   ▼
[DOMAIN ADMIN]  administrator\administrator  (root.txt)

1. Reconnaissance

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.59.211

Not shown: 65509 closed tcp ports (reset)
PORT      STATE SERVICE
21/tcp    open  ftp
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown

The 53+88+135+139+389+445+464+636+3268+3269+9389 footprint is a textbook Domain Controller. What isn't textbook: port 21. A DC has no operational reason to serve FTP. When a scan reveals a service that doesn't belong to the host's role, it's almost always the element added on purpose — and in a real environment, the asset nobody remembers installing. Flagged as a priority target from minute one.

sudo nmap -p21,53,88,135,389,445,5985 -sCV -oN scans/services.txt 10.129.59.211

PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-09-17 22:17:24Z)
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

Host script results:
|_clock-skew: 7h00m05s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

Three actionable facts from this scan: the domain is administrator.htb (use this name in every tool from here on), there's a 7-hour clock skew that will break Kerberos until fixed (§1.1), and SMB signing is required, which rules out any NTLM relay outright.

sudo bash -c 'echo "10.129.59.211 administrator.htb dc.administrator.htb DC" >> /etc/hosts'

Kerberos issues tickets for a Service Principal Name built from the service's name, not its IP. Attacking by address forces a fallback to NTLM, and with SMB signing required several paths close down. All work targets dc.administrator.htb from here on.

1.1 The Kerberos clock skew

date          # Thu Sep 17 03:17:37 PM UTC 2026   <- Kali
              # server time:  2026-09-17 22:17:24Z <- DC

Kerberos embeds timestamps in the authenticator specifically to prevent replay attacks, and the KDC rejects any request whose skew exceeds MaxTimeSkew (5 minutes by default). With a 7-hour gap, every Kerberos operation fails with KRB_AP_ERR_SKEW.

sudo ntpdate -u 10.129.59.211

CLOCK: time stepped by 25206.536621
2026-09-17 22:17:43.794292 (+0000) +25206.536621 +/- 0.018821 10.129.59.211 s1 no-leap

The mistake that cost an attempt: after syncing, the first GetUserSPNs failed again with KRB_AP_ERR_SKEW. The cause was that systemd-timesyncd was still active on Kali and re-adjusted the clock back to the real time within minutes, undoing the manual sync. Syncing once isn't enough: the system's NTP service has to be disabled for the duration of the exercise.

sudo systemctl stop systemd-timesyncd
sudo timedatectl set-ntp false
sudo ntpdate -u 10.129.59.211

CLOCK: time stepped by 25214.667703
Thu Sep 17 10:20:52 PM UTC 2026

From here on every Kerberos operation works. Alternative without touching the system clock: faketime shifts time only for the attacking process, avoiding broken TLS certificates or local logs — the correct choice in a real engagement.

Resumen ejecutivo — Administrator es un escenario de assumed breach: se entrega una credencial de dominio de bajo privilegio y el objetivo es llegar a Domain Admin. No hay ni un solo CVE en toda la cadena — el compromiso completo se apoya en permisos delegados de Active Directory mal otorgados, encadenados unos con otros, más un fichero de copia de seguridad que nunca debió estar en un servicio FTP corriendo en el propio controlador de dominio. Es, precisamente por eso, un ejercicio muy representativo de un AD corporativo real: la ruta de ataque no la abre un parche pendiente, sino la acumulación histórica de delegaciones que nadie volvió a auditar como grafo.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2022
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.59.211`

Mapa del ataque

[ENTREGADO]  olivia : ichliebedich   (assumed breach)
   │  ACL  GenericAll  sobre el objeto usuario michael
   ▼
[ACL #1]  michael           ◄── bloodyAD set password
   │  ACL  ForceChangePassword  sobre el objeto usuario benjamin
   ▼
[ACL #2]  benjamin          ◄── unico miembro de "Share Moderators"
   │  21/FTP → home dir accesible → Backup.psafe3 (952 bytes)
   ▼
[Password Safe V3]  pwsafe2john + rockyou → master "tekieromucho"
   │  Twofish-CBC → alexander✗ (deshabilitada) · emma✗ (deshabilitada) · emily✓
   ▼
[emily]  Remote Management Users → WinRM  (user.txt)
   │  ACL  GenericWrite  sobre ethan → SPN falso plantado
   ▼
[Targeted Kerberoasting]  TGS de ethan crackeado → "limpbizkit"
   │  ACL  GetChanges + GetChangesAll  sobre el objeto DOMINIO
   ▼
[DCSync]  hash NT de Administrator: 3dc553ce4b9fd20bd016e098d2d2fd2e
   │  Pass-the-Hash → WinRM 5985
   ▼
[DOMAIN ADMIN]  administrator\administrator  (root.txt)

1. Reconocimiento

sudo nmap -p- --min-rate 3000 -T4 -Pn -oN scans/allports.txt 10.129.59.211

Not shown: 65509 closed tcp ports (reset)
PORT      STATE SERVICE
21/tcp    open  ftp
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown

La huella 53+88+135+139+389+445+464+636+3268+3269+9389 es la de un Domain Controller de manual. Lo que no lo es: el puerto 21. Un DC no tiene ninguna razón operativa para servir FTP. Cuando un escaneo revela un servicio ajeno al rol del host, es casi siempre el elemento añadido a propósito — y en un entorno real, el activo que nadie recuerda haber instalado. Se anota como objetivo prioritario desde el minuto uno.

sudo nmap -p21,53,88,135,389,445,5985 -sCV -oN scans/services.txt 10.129.59.211

PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-09-17 22:17:24Z)
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

Host script results:
|_clock-skew: 7h00m05s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

Tres datos accionables de este escaneo: el dominio es administrator.htb (nombre a usar en todas las herramientas), hay un desfase de reloj de 7 horas que romperá Kerberos hasta corregirlo (§1.1), y la firma SMB es obligatoria, lo que descarta de raíz cualquier relay NTLM.

sudo bash -c 'echo "10.129.59.211 administrator.htb dc.administrator.htb DC" >> /etc/hosts'

Kerberos emite tickets para un Service Principal Name construido a partir del nombre del servicio, no de su IP. Atacar por dirección fuerza a caer en NTLM, y con la firma SMB obligatoria varias vías quedan cerradas. Se trabaja siempre contra dc.administrator.htb.

1.1 El desfase horario de Kerberos

date          # Thu Sep 17 03:17:37 PM UTC 2026   <- Kali
              # server time:  2026-09-17 22:17:24Z <- DC

Kerberos incluye marcas de tiempo en el autenticador para impedir ataques de repetición, y el KDC rechaza cualquier petición cuyo desfase supere MaxTimeSkew (5 minutos por defecto). Con 7 horas de diferencia, cualquier operación Kerberos falla con KRB_AP_ERR_SKEW.

sudo ntpdate -u 10.129.59.211

CLOCK: time stepped by 25206.536621
2026-09-17 22:17:43.794292 (+0000) +25206.536621 +/- 0.018821 10.129.59.211 s1 no-leap

El fallo que costó un intento: tras sincronizar, el primer GetUserSPNs volvió a fallar con KRB_AP_ERR_SKEW. La causa era que systemd-timesyncd seguía activo en Kali y reajustó el reloj a la hora real a los pocos minutos, deshaciendo la sincronización manual. Sincronizar una vez no basta: hay que desactivar el servicio NTP del sistema mientras dure el ejercicio.

sudo systemctl stop systemd-timesyncd
sudo timedatectl set-ntp false
sudo ntpdate -u 10.129.59.211

CLOCK: time stepped by 25214.667703
Thu Sep 17 10:20:52 PM UTC 2026

A partir de aquí todas las operaciones Kerberos funcionan. Alternativa sin tocar el reloj del sistema: faketime desplaza el tiempo solo para el proceso atacante, evitando romper certificados TLS o logs locales — la opción correcta en un engagement real.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.