Voleur
Executive summary — Voleur (French for "thief") is a Domain Controller with one detail that shapes the entire operation: NTLM is disabled (
NTLM:False), so every authentication step — from the very firstkinittoroot.txt— has to go through Kerberos. It's an assumed breach box: it starts from a first-line support credential and chains six Active Directory techniques, each unlocking the next: an encrypted Excel file leaks service-account passwords and the password of an already-deleted account; a Targeted Kerberoasting via ACL abuse grants WinRM access; the AD Recycle Bin resurrects that deleted account; its DPAPI blobs, archived on an SMB share, hide a third user's password; that user reaches an SSH key that opens a WSL instance running inside the DC itself with passwordlesssudo; and there, a poorly guarded Active Directory backup hands over a fullntds.ditfor an offline dump and an overpass-the-hash all the way to Domain Admin.
| Platform | Hack The Box |
| Operating system | Windows (Active Directory, Kerberos-only) |
| Difficulty | Medium |
| Status | Retired |
| Target IP | 10.129.49.32 |
Attack map
[Assumed breach] ryan.naylor : HollowOct31Nyt -- NTLM:False, everything over Kerberos
| SMB \\DC\IT -> encrypted Access_Review.xlsx
v
[office2john + rockyou] "football1" -> svc_ldap / svc_iis / todd.wolfe creds (DELETED)
| svc_ldap holds WriteSPN over svc_winrm (ACL abuse)
v
[Targeted Kerberoasting] fake SPN on svc_winrm -> TGS -> crack -> AFireInsidedeOzarctica980219afi
| svc_winrm in Remote Management Users
v
[WinRM] svc_winrm -> user.txt
| svc_ldap in Restore_Users -> Reanimate Tombstone (AD Recycle Bin)
v
[Restore] todd.wolfe -- archived profile on SMB \\IT\...\Archived Users
| DPAPI blobs (masterkey + credential) decryptable with todd's password
v
[DPAPI] -> jeremy.combs : qT3V9pLXyN7W4m
| SMB \\IT\Third-Line Support -> svc_backup's id_rsa
v
[SSH :2222] Linux WSL INSIDE the DC -> svc_backup (sudo NOPASSWD:ALL)
| /mnt/c/... AD backup: ntds.dit + SYSTEM + SECURITY
v
[offline secretsdump] Administrator NTLM + AES256
v
[ROOT] overpass-the-hash -> Kerberos TGT -> wmiexec Domain Admin -> root.txt1. Reconnaissance and Kerberos environment setup
The starting point isn't a vulnerability, it's a credential: ryan.naylor : HollowOct31Nyt, a typical assumed breach where the goal isn't initial access but everything that follows it. Before touching anything there's an infrastructure problem of my own to fix: with NTLM disabled, every operation — SMB, LDAP, WinRM — requires a valid Kerberos ticket, and Kerberos has zero tolerance for clock drift.
sudo timedatectl set-ntp false
sudo systemctl disable --now systemd-timesyncd
sudo ntpdate -u 10.129.49.32 # repeat right before operatingThe DC was running about 8 hours ahead of the local clock, and Kerberos rejects any ticket with a skew above 5 minutes (KRB_AP_ERR_SKEW). Syncing once isn't enough: systemd-timesyncd and VirtualBox's virtual clock both tend to revert the time as soon as networking reconnects, so both get disabled and the sync gets repeated by hand before every working session.
The second, less obvious fix turned out to be decisive: forcing TCP for the KDC.
[libdefaults]
default_realm = VOLEUR.HTB
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
udp_preference_limit = 1 # forces TCP: kills intermittent timeouts
[realms]
VOLEUR.HTB = { kdc = DC.voleur.htb }
[domain_realm]
.voleur.htb = VOLEUR.HTBA Kerberos ticket carrying a large PAC (Privilege Attribute Certificate) — the case for accounts in many groups, as would later show up with
todd.wolfe— doesn't fit in a single UDP datagram. Withoutudp_preference_limit = 1, those packets fragment and the box's KDC drops them intermittently, which surfaces as erratic errors (a phantomKRB_AP_ERR_SKEW,Invalid token) that have nothing to do with the clock or the credential. Forcing TCP inkrb5.confremoves them at the root.
echo '10.129.49.32 voleur.htb DC.voleur.htb DC' | sudo tee -a /etc/hosts
echo 'HollowOct31Nyt' | kinit ryan.naylor@VOLEUR.HTBsudo nmap -Pn -p- --min-rate 2000 10.129.49.32The port profile is a textbook DC — 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268/3269, 5985 (WinRM), 9389 (ADWS) — except for one port that doesn't fit: 2222, an SSH service on a non-standard port that, unknowingly at this point, is the back door into a Linux subsystem running inside the domain controller itself.
SMB 10.129.49.32 445 DC (name:DC) (domain:voleur.htb) (signing:True) (NTLM:False)NTLM:False confirms on the ground what was already suspected: the domain enforces pure Kerberos, with no NTLM fallback available even for quick checks.
export KRB5CCNAME=/tmp/krb5cc_1000
netexec ldap DC.voleur.htb -k --use-kcache --usersEleven users, with a support hierarchy visible right in the names — first-, second- and third-line technicians — plus four service accounts that will become the protagonists: svc_ldap, svc_backup, svc_iis, svc_winrm.
netexec smb DC.voleur.htb -k --use-kcache --shares
# ... IT (READ), Finance, HR, NETLOGON, SYSVOL ...
bloodhound-python -d voleur.htb -u ryan.naylor -k -no-pass -ns 10.129.49.32 \
--dns-tcp --auth-method kerberos -c all --zip -dc DC.voleur.htbThe IT share, readable by ryan.naylor, already points to where to look first. BloodHound, over the ACL graph, surfaces the edge that acts as the hinge between the first and second hop of the chain:
SVC_LDAP@VOLEUR.HTB --WriteSPN--> SVC_WINRM@VOLEUR.HTBsvc_ldap can write the servicePrincipalName attribute of svc_winrm. There's no credential for svc_ldap yet, but it's already clear what to do with one as soon as it shows up: a Targeted Kerberoasting.
Resumen ejecutivo — Voleur ("ladrón" en francés) es un Domain Controller con una particularidad que condiciona toda la operación: NTLM está deshabilitado (
NTLM:False), así que cada autenticación —desde el primerkinithasta elroot.txt— tiene que pasar por Kerberos. Es una caja de tipo assumed breach: se arranca con una credencial de soporte de primera línea y se encadenan seis técnicas de Active Directory, cada una desbloqueando la siguiente: un Excel cifrado filtra contraseñas de servicio y la de una cuenta ya borrada; un Targeted Kerberoasting vía abuso de ACL da acceso WinRM; la Papelera de reciclaje de AD permite resucitar esa cuenta borrada; sus blobs DPAPI archivados en un recurso SMB esconden la contraseña de un tercer usuario; ese usuario llega a una clave SSH que abre un WSL corriendo dentro del propio DC consudosin contraseña; y ahí, un backup de Active Directory mal custodiado entregantds.ditcompleto para un volcado offline y un overpass-the-hash hasta Domain Admin.
| Plataforma | Hack The Box |
| Sistema operativo | Windows (Active Directory, Kerberos-only) |
| Dificultad | Medium |
| Estado | Retired |
| IP objetivo | 10.129.49.32 |
Mapa del ataque
[Assumed breach] ryan.naylor : HollowOct31Nyt -- NTLM:False, todo por Kerberos
| SMB \\DC\IT -> Access_Review.xlsx cifrado
v
[office2john + rockyou] "football1" -> creds svc_ldap / svc_iis / todd.wolfe (BORRADA)
| svc_ldap tiene WriteSPN sobre svc_winrm (abuso de ACL)
v
[Targeted Kerberoasting] SPN falso en svc_winrm -> TGS -> crack -> AFireInsidedeOzarctica980219afi
| svc_winrm in Remote Management Users
v
[WinRM] svc_winrm -> user.txt
| svc_ldap in Restore_Users -> Reanimate Tombstone (AD Recycle Bin)
v
[Restaurar] todd.wolfe -- perfil archivado en SMB \\IT\...\Archived Users
| blobs DPAPI (masterkey + credential) descifrables con password de todd
v
[DPAPI] -> jeremy.combs : qT3V9pLXyN7W4m
| SMB \\IT\Third-Line Support -> id_rsa de svc_backup
v
[SSH :2222] WSL Linux DENTRO del DC -> svc_backup (sudo NOPASSWD:ALL)
| /mnt/c/... backup de AD: ntds.dit + SYSTEM + SECURITY
v
[secretsdump offline] Administrator NTLM + AES256
v
[ROOT] overpass-the-hash -> TGT Kerberos -> wmiexec Domain Admin -> root.txt1. Reconocimiento y preparación del entorno Kerberos
El punto de partida no es una vulnerabilidad, es una credencial: ryan.naylor : HollowOct31Nyt, un assumed breach típico de un ejercicio donde el objetivo no es el acceso inicial sino todo lo que viene después. Antes de tocar nada hay que resolver un problema de infraestructura propio: con NTLM desactivado, cualquier operación —SMB, LDAP, WinRM— exige un ticket Kerberos válido, y Kerberos es intolerante con el reloj.
sudo timedatectl set-ntp false
sudo systemctl disable --now systemd-timesyncd
sudo ntpdate -u 10.129.49.32 # repetir justo antes de operarEl DC iba unas 8 horas por delante del reloj local, y Kerberos rechaza cualquier ticket con un desfase mayor a 5 minutos (KRB_AP_ERR_SKEW). Sincronizar una vez no basta: systemd-timesyncd y el reloj virtual de VirtualBox tienden a revertir la hora en cuanto se reconecta la red, así que ambos se desactivan y la sincronización se repite a mano antes de cada sesión de trabajo.
El segundo ajuste, menos evidente, resultó decisivo: forzar TCP para el KDC.
[libdefaults]
default_realm = VOLEUR.HTB
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
udp_preference_limit = 1 # fuerza TCP: elimina timeouts intermitentes
[realms]
VOLEUR.HTB = { kdc = DC.voleur.htb }
[domain_realm]
.voleur.htb = VOLEUR.HTBUn ticket Kerberos con un PAC (Privilege Attribute Certificate) grande —el caso de cuentas con muchas pertenencias a grupos, como se vería más adelante con
todd.wolfe— no cabe en un único datagrama UDP. Sinudp_preference_limit = 1, esos paquetes se fragmentan y el KDC de la máquina los descarta de forma intermitente, lo que se manifiesta como errores erráticos (KRB_AP_ERR_SKEWfantasma,Invalid token) que no tienen nada que ver con el reloj ni con la credencial. Forzar TCP enkrb5.conflos elimina de raíz.
echo '10.129.49.32 voleur.htb DC.voleur.htb DC' | sudo tee -a /etc/hosts
echo 'HollowOct31Nyt' | kinit ryan.naylor@VOLEUR.HTBsudo nmap -Pn -p- --min-rate 2000 10.129.49.32El perfil de puertos es el de un DC de manual —53, 88, 135, 139, 389, 445, 464, 593, 636, 3268/3269, 5985 (WinRM), 9389 (ADWS)— salvo por uno que no encaja: 2222, un SSH en puerto no estándar que, sin saberlo todavía, es la puerta trasera hacia un subsistema Linux corriendo dentro del propio controlador de dominio.
SMB 10.129.49.32 445 DC (name:DC) (domain:voleur.htb) (signing:True) (NTLM:False)NTLM:False confirma sobre el terreno lo que ya se sospechaba: el dominio exige Kerberos puro, sin fallback NTLM posible ni siquiera para pruebas rápidas.
export KRB5CCNAME=/tmp/krb5cc_1000
netexec ldap DC.voleur.htb -k --use-kcache --usersOnce usuarios, con una jerarquía de soporte visible en los propios nombres —técnicos de primera, segunda y tercera línea— más cuatro cuentas de servicio que van a ser protagonistas: svc_ldap, svc_backup, svc_iis, svc_winrm.
netexec smb DC.voleur.htb -k --use-kcache --shares
# ... IT (READ), Finance, HR, NETLOGON, SYSVOL ...
bloodhound-python -d voleur.htb -u ryan.naylor -k -no-pass -ns 10.129.49.32 \
--dns-tcp --auth-method kerberos -c all --zip -dc DC.voleur.htbEl recurso IT con lectura para ryan.naylor ya apunta a dónde mirar primero. BloodHound, sobre el grafo de ACLs, revela la arista que hace de bisagra entre el primer y el segundo salto de la cadena:
SVC_LDAP@VOLEUR.HTB --WriteSPN--> SVC_WINRM@VOLEUR.HTBsvc_ldap puede escribir el atributo servicePrincipalName de svc_winrm. Todavía no hay credencial para svc_ldap, pero ya se sabe qué hacer con ella en cuanto aparezca: un Targeted Kerberoasting.
This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.
See Root Access plansNo account? Create one free then upgrade from your console.
Este contenido es solo para Root Access. Todo lo demás del sitio — el nivel gratuito, toda la biblioteca pública — sigue abierto.
Ver planes de Root Access¿Sin cuenta? Crea una gratis y luego mejora desde tu consola.