Hackthebox Writeup
Campfire 1
Cybersecurity
Hackthebox Walkthrough
Hack The Box Writeup

HTB CampFire-1 Sherlock Writeup

SleepySOC

5 min readAug 18, 2026

HTB blue team sherlock contains 7 questions to answer so lets start answering them,

Q1:

Analyzing Domain Controller Security Logs, can you confirm the UTC date & time when the kerberoasting activity occurred?

so first of all we have to download the file they have provided us,
after that we will obtain the .evtx file which is windows log file we can open that in an online evtx viewer (if we are on linux)

Now lets answer first question,
so the ID used for kerberoasting activity in 4769 by filtering it we will get some logs then we will move to the analysis them by there TicketEncryptionType for kerberoasting it should be RC4 encryption which is 0x17 type

Answer : 2024–05–21 03:18:09

Q2:

What is the Service Name that was targeted?

now to the next question
its in the same area as the previous question the field to look for is ServiceName in the 4769 log filter with 0x17 type of encryption

Answer : MSSQLService

Q3:

It is really important to identify the Workstation from which this activity occurred. What is the IP Address of the workstation?

In same log there is a field named IpAddress

Answer: 172.17.79.129

Q4:

Now that we have identified the workstation, a triage including PowerShell logs and Prefetch files are provided to you for some deeper insights so we can understand how this activity occurred on the endpoint. What is the name of the file used to Enumerate Active directory objects and possibly find Kerberoastable accounts in the network?

IN the file we have Powershell operational .evtx file we need to open it and then filter log with Event ID 4104 which is PowerShell Script Block Logging
and after getting the filtered logs we will check them against the UTC time of kerberoasting attack (Q1) after doing all this we can see

in path we can see our answer
Answer: powerview.ps1

Q5:

When was this script executed? (UTC)

Get SleepySOC’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

in the log look at Date & Time column for the same log

Answer: 2024–05–21 03:16:32

Q6:

What is the full path of the tool used to perform the actual kerberoasting attack?

Hint: Parse the prefetch files using the PEcmd Tool by Eric Zimmerman. The syntax is Pecmd.exe -d “Path of prefetchArtifacts” — csv . — csvf result.csv. This command will create a CSV called result.csv in your current directory from where you are executing the CLI Tool. Open the CSV file in the Timeline Explorer tool(Another Eric Zimmerman tool), then look for any executables executed around the timeline we have established so far. A certain tool name will catch your eye. Then to get the path, go to the Files Loaded column and double-click the value to get a list of files interacted by the executable. It will also include its path. We already followed the hint and created the CSV file. Let’s open it in Timeline Explorer and follow the breadcrumbs in the hint. Timeline Explorer is a forensic tool developed by Eric Zimmerman. It is used for visualizing and analyzing timelines from various data sources, particularly useful for incident response and digital forensics investigations. Timeline Explorer can ingest CSV files and allows investigators to filter, sort, and search through large datasets efficiently. Key features include: Customizable Views: Users can configure columns, sorting, and filtering to tailor the data presentation to their needs. Data Integration: It supports integrating data from multiple sources, helping to create a comprehensive timeline of events. Efficiency: It handles large datasets effectively, making it a powerful tool for forensic analysis

We should look for any execution around the timeline we established so far. Let’s filter for the date of the incident to reduce the noise. We add the filter for the “Last Run” field.

We still have lots of results. A trick we can use is to only look for entries which have the last run entry filled and previous run entries empty. These are the executables that were run on the system for the first time. We spot an executable named after a well-known active directory offensive tool.

We can also look for files on the basis of their last run time.

The Rubeus tool was executed just 1 second before our DC logged the malicious event. Rubeus is a post-exploitation tool used for Kerberos-related attacks in Active Directory environments. Developed as a part of the offensive toolkit, Rubeus provides capabilities to: Kerberoasting: Extract service tickets (TGS tickets) that can be cracked offline to retrieve service account passwords. Pass-the-Ticket (PTT): Inject and use Kerberos tickets directly into a user’s session. Ticket Renewal and Overpass-the-Hash: Request new tickets using valid Kerberos ticketgranting ticket (TGT) or hash values. S4U: Perform Service-for-User attacks, requesting tickets on behalf of other users. To get the full path of the file, go to the files loaded and double-click to see all files loaded by this tool at execution.