root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat resolute.md
// writeups

Resolute

7 Dec 2019 · 14 min read · root access
writeupshacktheboxwindowsMediumretiredvip
Resolute - maquina de Hack The Box

Executive summary — Resolute is a Medium Active Directory box that shows why enumerating attribute fields and groups pays off. The domain allows null sessions over RPC and LDAP: with no credentials at all, domain users can be listed, and one of them has an initial password an administrator documented in its Description attribute. Through reuse, that password also works for melanie (user flag). Searching for references to a second user across the system turns up a PowerShell transcript with ryan's cleartext credentials — a member of DnsAdmins. That group's classic abuse — a malicious DLL loaded by the DNS service on restart — adds ryan to Domain Admins and hands over full control of the domain.

PlatformHack The Box
Operating systemWindows — Domain Controller
Domainmegabank.local
DifficultyMedium
StatusRetired
Target IP10.129.96.155
Attacker IP<ATTACKER_IP>

Attack map

[1] Recon -- megabank.local DC; enum4linux/rpcclient with no auth -> user list
        |
[2] rpcclient queryuser (marko) -- Description: "Password set to Welcome123!"
        |
[3] Password spraying (Welcome123!) -- valid for melanie (Remote Management Users)
      +-> evil-winrm  ->  user.txt
        |
[4] Recursive search for "ryan" -- a PSTranscript reveals cleartext credentials
      (net use X: \\fs01\backups ryan Serv3r4Admin4cc123!)
        |
[5] ryan belongs to DnsAdmins -- classic abuse: a malicious DLL (msfvenom) that adds
      ryan to Domain Admins
        |
[6] impacket-smbserver serves the DLL -> dnscmd serverlevelplugindll points at the SMB share
      +-> sc.exe stop/start dns -- the DNS service loads the DLL as SYSTEM on startup
        |
[7] Re-authenticate as ryan -- now in Domain Admins  ->  root.txt

1. Initial reconnaissance

nmap -p- --min-rate 1000 -T4 10.129.96.155 -oN nmap_all_ports.txt
nmap -sC -sV -O -p53,88,135,139,389,445,464,593,636,3268,3269,5985 10.129.96.155 -oN nmap_services.txt

Full port scan first (every port, high rate), then a service/version detection pass against only the open ports: faster, and it won't miss services on non-standard ports. The result is a very recognizable combination:

  • 53 (DNS) — the DC itself hosts the AD-integrated DNS zone.
  • 88 (Kerberos) — domain authentication; only a DC exposes it.
  • 135/139/445 (RPC/SMB) — shares and RPC calls, including SAM enumeration.
  • 389/636/3268/3269 (LDAP/LDAPS + Global Catalog) — a queryable AD directory.
  • 5985 (WinRM) — remote management; this becomes the way in once we get valid credentials for an account allowed to use it.

This port combination is basically the fingerprint of a Domain Controller: it all but guarantees the attack path runs through enumerating AD objects (users, groups, attributes) rather than through a web service or an isolated software vulnerability.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.