Blackfield — HTB Writeup | The Hack Sparrow

Executive summary — Blackfield is an Active Directory DC (Windows) where SMB guest access leaks a full list of domain users, and one of them (support) has Kerberos pre-authentication disabled: AS-REP roasting plus cracking recovers its password. support has ForceChangePassword over audit2020, an account that unlocks the forensic share holding an LSASS dump: that yields svc_backup's NTLM hash (user flag). With that account's SeBackupPrivilege/SeRestorePrivilege, a shadow copy (DiskShadow) dodges the in-use file lock and copies ntds.dit plus the SYSTEM hive; secretsdump.py dumps Administrator's hash → Pass-the-Hash → root.

Platform	Hack The Box
Operating system	Windows Server — Domain Controller (Active Directory)
Domain	`BLACKFIELD.local`
DC hostname	`DC01`
Difficulty	Hard
Status	Retired
Target IP	`10.129.229.17`

Attack map

[SMB guest] profiles$ share -> domain user list
   |  AS-REP roasting -> support (pre-auth off) -> crack -> #00^BlackKnight
   v
[support]  BloodHound -> ForceChangePassword over audit2020
   |  rpcclient setuserinfo2 -> reset audit2020 -> forensic share now accessible
   v
[audit2020]  forensic/lsass.zip -> pypykatz -> svc_backup NTLM hash
   v
[svc_backup]  evil-winrm (user.txt) -> SeBackupPrivilege
   |  DiskShadow (shadow copy) + robocopy -> copy ntds.dit + SYSTEM (dodges the lock)
   v
[ADMIN]  secretsdump.py -> Administrator hash -> Pass-the-Hash -> root.txt

1. Reconnaissance

echo "10.129.229.17 blackfield.local dc01.blackfield.local" | sudo tee -a /etc/hosts

nmap -p- --min-rate 10000 -oA nmap-alltcp 10.129.229.17
nmap -sC -sV -p53,88,135,389,445,593,3268,5985 -oA nmap-tcpscripts 10.129.229.17

The open ports (53, 88, 135, 389, 445, 593, 3268, 5985) are typical of a Domain Controller. Nmap and LDAP identify the domain BLACKFIELD.local, and CrackMapExec confirms the hostname DC01.

dig @10.129.229.17 blackfield.local
ldapsearch -h 10.129.229.17 -x -s base namingcontexts

DC=BLACKFIELD,DC=local confirmed: we're facing an Active Directory DC.

Resumen ejecutivo — Blackfield es un DC de Active Directory (Windows) donde el SMB guest filtra una lista completa de usuarios del dominio, y uno de ellos (support) tiene la preautenticación Kerberos deshabilitada: AS-REP roasting y crackeo dan su contraseña. support tiene ForceChangePassword sobre audit2020, cuenta que destapa el share forensic con un dump de LSASS: de ahí sale el hash NTLM de svc_backup (user flag). Con los privilegios SeBackupPrivilege/SeRestorePrivilege de esa cuenta, una copia de sombra (DiskShadow) esquiva el bloqueo del fichero en uso y permite copiar ntds.dit + el hive SYSTEM; secretsdump.py vuelca el hash de Administrator → Pass-the-Hash → root.

Plataforma	Hack The Box
Sistema operativo	Windows Server — Domain Controller (Active Directory)
Dominio	`BLACKFIELD.local`
Hostname DC	`DC01`
Dificultad	Hard
Estado	Retired
IP objetivo	`10.129.229.17`

Mapa del ataque

[SMB guest] share profiles$ -> lista de usuarios del dominio
   |  AS-REP roasting -> support (pre-auth off) -> crack -> #00^BlackKnight
   v
[support]  BloodHound -> ForceChangePassword sobre audit2020
   |  rpcclient setuserinfo2 -> resetear audit2020 -> share forensic accesible
   v
[audit2020]  forensic/lsass.zip -> pypykatz -> hash NTLM de svc_backup
   v
[svc_backup]  evil-winrm (user.txt) -> SeBackupPrivilege
   |  DiskShadow (shadow copy) + robocopy -> copiar ntds.dit + SYSTEM (evita el lock)
   v
[ADMIN]  secretsdump.py -> hash de Administrator -> Pass-the-Hash -> root.txt

1. Reconocimiento

echo "10.129.229.17 blackfield.local dc01.blackfield.local" | sudo tee -a /etc/hosts

nmap -p- --min-rate 10000 -oA nmap-alltcp 10.129.229.17
nmap -sC -sV -p53,88,135,389,445,593,3268,5985 -oA nmap-tcpscripts 10.129.229.17

Los puertos abiertos (53, 88, 135, 389, 445, 593, 3268, 5985) son los típicos de un Domain Controller. Nmap y LDAP identifican el dominio BLACKFIELD.local, y CrackMapExec confirma el hostname DC01.

dig @10.129.229.17 blackfield.local
ldapsearch -h 10.129.229.17 -x -s base namingcontexts

Se confirma DC=BLACKFIELD,DC=local: estamos ante un DC de Active Directory.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.