Intelligence — HTB Writeup | The Hack Sparrow

Executive summary — Intelligence is a Medium Active Directory box where the initial vector lives in public PDF metadata: the Creator field of dozens of predictably-named documents reveals the domain's username format, and one of them documents a default password. With password spraying we get the first account (user flag). A share leaks a script that HTTP-queries web* DNS records every 5 minutes: creating a malicious one and capturing with Responder yields a second user's NTLMv2 hash. That account can read a gMSA's password with constrained delegation, which we use to forge an S4U2Self/S4U2Proxy ticket impersonating Administrator.

Platform	Hack The Box
Operating system	Windows — Domain Controller
Domain	`intelligence.htb`
Difficulty	Medium
Status	Retired
Target IP	`10.129.95.154`
tun0 (attacker)	`<ATTACKER_IP>`

Attack map

[1] Recon -- full Windows DC (53,80,88,135,139,389,445,464,593,636,5985,9389)
        |
[2] Web: /documents/ -- 403 (no listing) but PDFs with a date pattern YYYY-MM-DD-upload.pdf
      brute forcing 2020 dates -> dozens of PDFs downloaded
        |
[3] exiftool (Creator field) -- reveals domain users (FirstName.LastName)
      pdftotext + grep -- "New Account Guide" document with a default password
        |
[4] Password spraying (netexec) -- Tiffany.Molina:NewIntelligenceCorpUser9876
      +-> Users share accessible  ->  user.txt
        |
[5] IT share -- downdetector.ps1: queries web* DNS records every 5min and HTTP GETs them
      (notifies Ted.Graves@intelligence.htb)
        |
[6] dnstool.py (krbrelayx) -- create a webYuba record -> attacker IP ->
      Responder captures Ted.Graves' NTLMv2 -> cracked with John -> Mr.Teddy
        |
[7] As Ted.Graves: no useful WinRM access, but he can read a gMSA's password
        |
[8] gMSADumper -- NTLM hash (and AES keys) of the gMSA svc_int$
      svc_int$ has constrained delegation over WWW/dc.intelligence.htb
        |
[9] impacket-getST -- S4U2Self+S4U2Proxy impersonating Administrator ->
      impacket-psexec (Kerberos)  ->  root.txt

1. Initial reconnaissance

nmap -sCV -Pn 10.129.95.154

53/tcp    DNS       80/tcp    HTTP      88/tcp   Kerberos   135/tcp  RPC
139/tcp   NetBIOS   389/tcp   LDAP      445/tcp  SMB        464/tcp  Kerberos pwd change
593/tcp   RPC over HTTP   636/tcp LDAPS   5985/tcp WinRM   9389/tcp AD Web Services

Typical Windows Domain Controller services (Kerberos, LDAP/LDAPS, SMB, WinRM, AD Web Services), plus an 80/tcp that tells us a web app is running on the DC itself.

netexec smb 10.129.95.154 -u guest -p ''
smbclient -L //10.129.95.154 -N

No useful guest access — on to the web.

Resumen ejecutivo — Intelligence es una Medium de Active Directory donde el vector inicial vive en metadatos de PDFs públicos: el campo Creator de docenas de documentos con nombre predecible revela el formato de usuarios del dominio, y uno de ellos documenta una contraseña por defecto. Con password spraying conseguimos la primera cuenta (user flag). Un share filtra un script que consulta registros DNS web* por HTTP cada 5 minutos: creando uno malicioso y capturando con Responder obtenemos el hash NTLMv2 de un segundo usuario. Esa cuenta puede leer la contraseña de una gMSA con delegación restringida, que usamos para forjar un ticket S4U2Self/S4U2Proxy impersonando a Administrator.

Plataforma	Hack The Box
Sistema operativo	Windows — Domain Controller
Dominio	`intelligence.htb`
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.95.154`
tun0 (atacante)	`<ATTACKER_IP>`

Mapa del ataque

[1] Recon -- DC de Windows completo (53,80,88,135,139,389,445,464,593,636,5985,9389)
        |
[2] Web: /documents/ -- 403 (sin listado) pero PDFs con patron de fecha YYYY-MM-DD-upload.pdf
      fuerza bruta de fechas de 2020 -> decenas de PDFs descargados
        |
[3] exiftool (campo Creator) -- revela usuarios del dominio (Nombre.Apellido)
      pdftotext + grep -- documento "New Account Guide" con password por defecto
        |
[4] Password spraying (netexec) -- Tiffany.Molina:NewIntelligenceCorpUser9876
      +-> share Users accesible  ->  user.txt
        |
[5] Share IT -- downdetector.ps1: consulta cada 5min registros DNS web* y hace HTTP GET
      (notifica a Ted.Graves@intelligence.htb)
        |
[6] dnstool.py (krbrelayx) -- crear registro webYuba -> IP atacante ->
      Responder captura NTLMv2 de Ted.Graves -> crackeo con John -> Mr.Teddy
        |
[7] Con Ted.Graves: sin acceso util por WinRM, pero puede leer la password de una gMSA
        |
[8] gMSADumper -- hash NTLM (y claves AES) de la gMSA svc_int$
      svc_int$ tiene delegacion restringida sobre WWW/dc.intelligence.htb
        |
[9] impacket-getST -- S4U2Self+S4U2Proxy impersonando Administrator ->
      impacket-psexec (Kerberos)  ->  root.txt

1. Reconocimiento inicial

nmap -sCV -Pn 10.129.95.154

53/tcp    DNS       80/tcp    HTTP      88/tcp   Kerberos   135/tcp  RPC
139/tcp   NetBIOS   389/tcp   LDAP      445/tcp  SMB        464/tcp  Kerberos pwd change
593/tcp   RPC over HTTP   636/tcp LDAPS   5985/tcp WinRM   9389/tcp AD Web Services

Servicios típicos de un Domain Controller Windows (Kerberos, LDAP/LDAPS, SMB, WinRM, AD Web Services), más un 80/tcp que indica que hay una aplicación web corriendo en el propio DC.

netexec smb 10.129.95.154 -u guest -p ''
smbclient -L //10.129.95.154 -N

Sin acceso útil por invitado — pasamos a la web.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.