Support — HTB Writeup | The Hack Sparrow

Executive summary — Support is an Active Directory domain controller (Windows) solved by chaining credential leaks: an SMB share reachable via null session exposes an internal .NET tool with embedded, obfuscated LDAP credentials; those credentials let us read the info attribute of the support user (its cleartext password), and a GenericAll relationship over the DC's own machine object enables an RBCD attack that ends in DCSync and Pass-the-Hash as Administrator. A SMB → .NET → LDAP → RBCD → DCSync → Root path.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.33.20`

Attack map

[SMB]  null session / Guest enabled
   │  smbclient -N -L → share "support-tools"
   ▼
[.NET]  UserInfo.exe → embedded LDAP credentials (XOR)
   │  ilspycmd → decompile → decode → support\ldap
   ▼
[LDAP]  authenticated bind → "info" attribute
   │  cleartext password of the  support  user
   ▼
[BloodHound]  Shared Support Accounts → GenericAll over DC$
   │  RBCD: addcomputer + rbcd write + getST (S4U2Self/Proxy)
   ▼
[DCSync]  secretsdump → Administrator NTLM hash
   │  Pass-the-Hash (wmiexec)
   ▼
[ROOT]  Administrator → user.txt & root.txt

1. Reconnaissance

We start by mapping the whole surface with a full nmap scan (all ports, default scripts and version detection):

nmap -sC -sV -p- --min-rate 3000 -oN nmap_10.129.33.20.txt 10.129.33.20

Result (summary):

53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: support.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  ncacn_http
636/tcp   open  tcpwrapped     (LDAPS)
3268/tcp  open  ldap           (Global Catalog)
3269/tcp  open  tcpwrapped     (GC SSL)
5985/tcp  open  http           WinRM
9389/tcp  open  mc-nmf         .NET Message Framing (AD Web Services)
49664+    open  msrpc          (dynamic RPC ports)
Service Info: Host: DC; OS: Windows

Analysis: the port set —DNS (53), Kerberos (88), LDAP (389/636/3268), SMB (445), WinRM (5985) and AD Web Services (9389)— is the classic Domain Controller profile for Active Directory. The domain is support.htb and the DC host is DC.

We register the domain and the DC hostname in /etc/hosts so Kerberos and LDAP resolve by name:

echo "10.129.33.20 support.htb dc.support.htb DC.support.htb DC" | sudo tee -a /etc/hosts

Resumen ejecutivo — Support es un controlador de dominio de Active Directory (Windows) que se resuelve encadenando fugas de credenciales: un recurso SMB accesible con sesión nula expone una herramienta interna .NET con las credenciales LDAP embebidas y ofuscadas; esas credenciales permiten leer el atributo info del usuario support (su contraseña en claro), y una relación GenericAll sobre el objeto de máquina del propio DC habilita un ataque RBCD que desemboca en DCSync y Pass-the-Hash como Administrator. Un recorrido SMB → .NET → LDAP → RBCD → DCSync → Root.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.33.20`

Mapa del ataque

[SMB]  sesion nula / Guest habilitados
   │  smbclient -N -L → recurso «support-tools»
   ▼
[.NET]  UserInfo.exe → credenciales LDAP embebidas (XOR)
   │  ilspycmd → descompilar → decodificar → support\ldap
   ▼
[LDAP]  bind autenticado → atributo «info»
   │  contraseña en claro del usuario  support
   ▼
[BloodHound]  Shared Support Accounts → GenericAll sobre DC$
   │  RBCD: addcomputer + rbcd write + getST (S4U2Self/Proxy)
   ▼
[DCSync]  secretsdump → hash NTLM de Administrator
   │  Pass-the-Hash (wmiexec)
   ▼
[ROOT]  Administrator → user.txt & root.txt

1. Reconocimiento

Arrancamos mapeando toda la superficie con un escaneo completo de nmap (todos los puertos, scripts por defecto y detección de versiones):

nmap -sC -sV -p- --min-rate 3000 -oN nmap_10.129.33.20.txt 10.129.33.20

Resultado (resumen):

53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: support.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  ncacn_http
636/tcp   open  tcpwrapped     (LDAPS)
3268/tcp  open  ldap           (Global Catalog)
3269/tcp  open  tcpwrapped     (GC SSL)
5985/tcp  open  http           WinRM
9389/tcp  open  mc-nmf         .NET Message Framing (AD Web Services)
49664+    open  msrpc          (puertos RPC dinámicos)
Service Info: Host: DC; OS: Windows

Análisis: el conjunto de puertos —DNS (53), Kerberos (88), LDAP (389/636/3268), SMB (445), WinRM (5985) y AD Web Services (9389)— es el perfil clásico de un Domain Controller de Active Directory. El dominio es support.htb y el host del DC es DC.

Registramos el dominio y el hostname del DC en /etc/hosts para que Kerberos y LDAP resuelvan por nombre:

echo "10.129.33.20 support.htb dc.support.htb DC.support.htb DC" | sudo tee -a /etc/hosts

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account