TheFrizz — HTB Writeup | The Hack Sparrow

Executive summary — TheFrizz is a domain controller with NTLM disabled and a XAMPP stack running an unpatched school CMS. An unauthenticated arbitrary file write in Gibbon LMS (CVE-2023-45878) hands over a webshell; its database credentials crack a teacher's hash, and that account can only log in over SSH via Kerberos. From there, a file deleted into the Recycle Bin revives a base64-encoded deployment password belonging to a second account, a member of Group Policy Creator Owners — a group that, combined with link permission over the domain, is equivalent to Domain Admin: a Restricted Groups GPO linked to the domain root inserts that account as a local administrator on the domain controller itself.

Platform	Hack The Box
Operating system	Windows Server 2022 (Build 20348)
Difficulty	Medium
Status	Retired
Authentication	Kerberos only (NTLM disabled)
Target IP	`10.129.232.168`

Attack map

[80/HTTP] Gibbon LMS 25.0.00, unauthenticated (CVE-2023-45878) -> webshell as w.webservice
   |  config.php -> MySQL -> f.frizzle hash -> hashcat -m 1420 + rockyou
   v
[Kerberos/SSH] f.frizzle -- NTLM disabled, only gssapi-with-mic -> user.txt
   |  $Recycle.Bin -> deleted 7z -> WAPT install -> base64-encoded password
   v
[Credential] M.SchoolBus -- member of Group Policy Creator Owners
   |  New-GPO + New-GPLink at DC=frizz,DC=htb -> Restricted Groups
   v
[GPO] BUILTIN\Administrators rewritten -> M.SchoolBus is local admin on the DC
   |  impacket -k (Kerberos, NTLM disabled) -> smbexec
   v
[ROOT] NT AUTHORITY\SYSTEM -> root.txt

1. Reconnaissance

A full port sweep at a high rate limit trades away precision: out of 65,516 ports, some end up marked filtered because of the scan's own pace rather than an actual firewall.

sudo nmap -p- --min-rate 3000 -T4 -Pn -n --open -oN allports.nmap 10.129.232.168

The result is the textbook profile of a domain controller — 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268/3269, 9389 — plus SSH on 22. Port 80 is missing: it got caught among the filtered ports because of --min-rate. Since HTB machines built around a CMS usually have something listening on HTTP, it's worth forcing it explicitly rather than assuming there's no web service:

sudo nmap -p22,53,80,88,135,139,389,445,464,593,636,3268,3269,9389 -sCV -Pn -n -oN services.nmap 10.129.232.168

22/tcp   open  ssh           OpenSSH for_Windows_9.5
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
|_http-title: Did not follow redirect to http://frizzdc.frizz.htb/home/
88/tcp   open  kerberos-sec  (server time: 2026-08-30 23:40:03Z)
389/tcp  open  ldap          Domain: frizz.htb0., Site: Default-First-Site-Name
445/tcp  open  microsoft-ds?
|_clock-skew: 7h00m09s

Three things worth noting before moving on. The domain is frizz.htb, the host frizzdc — straight into /etc/hosts. Second, there's Apache and PHP running on a domain controller, almost certainly a XAMPP install; that alone signals the entry point is going to be the web app, not AD itself. And third, a seven-hour clock skew: Kerberos rejects any ticket more than five minutes off from the KDC, so any future Kerberos operation is going to fail until it's fixed.

echo "10.129.232.168 frizzdc.frizz.htb frizz.htb" | sudo tee -a /etc/hosts

Resumen ejecutivo — TheFrizz es un controlador de dominio con NTLM deshabilitado y un XAMPP corriendo un CMS escolar sin parchear. Una escritura de fichero arbitraria sin autenticar en Gibbon LMS (CVE-2023-45878) da una webshell; sus credenciales de base de datos crackean el hash de un profesor, que solo puede entrar por SSH sobre Kerberos. Desde ahí, un archivo borrado en la papelera de reciclaje resucita una contraseña de despliegue en base64 que pertenece a una segunda cuenta, miembro de Group Policy Creator Owners — un grupo que, combinado con permiso de enlace sobre el dominio, equivale a Domain Admin: una GPO de Restricted Groups vinculada a la raíz del dominio inserta a esa cuenta como administrador local del propio controlador de dominio.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2022 (Build 20348)
Dificultad	Medium
Estado	Retired
Autenticación	Kerberos únicamente (NTLM deshabilitado)
IP objetivo	`10.129.232.168`

Mapa del ataque

[80/HTTP] Gibbon LMS 25.0.00 sin auth (CVE-2023-45878) -> webshell w.webservice
   |  config.php -> MySQL -> hash de f.frizzle -> hashcat -m 1420 + rockyou
   v
[Kerberos/SSH] f.frizzle -- NTLM deshabilitado, solo gssapi-with-mic -> user.txt
   |  $Recycle.Bin -> 7z borrado -> instalacion WAPT -> password en base64
   v
[Credencial] M.SchoolBus -- miembro de Group Policy Creator Owners
   |  New-GPO + New-GPLink a DC=frizz,DC=htb -> Restricted Groups
   v
[GPO] BUILTIN\Administrators reescrito -> M.SchoolBus admin local del DC
   |  impacket -k (Kerberos, NTLM deshabilitado) -> smbexec
   v
[ROOT] NT AUTHORITY\SYSTEM -> root.txt

1. Reconocimiento

Un barrido completo de puertos con límite de tasa alto sacrifica precisión: en 65 516 puertos, algunos quedan marcados filtered por el propio ritmo del escaneo en lugar de por un firewall real.

sudo nmap -p- --min-rate 3000 -T4 -Pn -n --open -oN allports.nmap 10.129.232.168

El resultado es el perfil clásico de un controlador de dominio — 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268/3269, 9389 — más SSH en el 22. El puerto 80 no aparece: cayó entre los puertos filtered por el --min-rate. Como toda máquina HTB con un CMS de por medio suele tener algo escuchando en HTTP, conviene forzarlo explícitamente en vez de asumir que no hay web:

sudo nmap -p22,53,80,88,135,139,389,445,464,593,636,3268,3269,9389 -sCV -Pn -n -oN services.nmap 10.129.232.168

22/tcp   open  ssh           OpenSSH for_Windows_9.5
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12)
|_http-title: Did not follow redirect to http://frizzdc.frizz.htb/home/
88/tcp   open  kerberos-sec  (server time: 2026-08-30 23:40:03Z)
389/tcp  open  ldap          Domain: frizz.htb0., Site: Default-First-Site-Name
445/tcp  open  microsoft-ds?
|_clock-skew: 7h00m09s

Tres datos para anotar antes de seguir. El dominio es frizz.htb, el host frizzdc — directos a /etc/hosts. Segundo: hay Apache y PHP corriendo en un controlador de dominio, casi con toda seguridad un XAMPP; eso ya es una señal de que el punto de entrada va a ser web, no AD. Y tercero, un desfase de reloj de siete horas: Kerberos rechaza cualquier ticket con más de cinco minutos de diferencia respecto al KDC, así que cualquier operación Kerberos futura va a fallar hasta corregirlo.

echo "10.129.232.168 frizzdc.frizz.htb frizz.htb" | sudo tee -a /etc/hosts

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.