Hack The Box Support Writeup Easy Windows Active Directory
Support is an Easy-difficulty Windows Active Directory machine. It begins with an SMB share that allows anonymous access, where a .NET executable (UserInfo.exe) is found. This binary is used to query the domain’s LDAP server for user information. By decompiling the binary, the hardcoded LDAP bind password obfuscated with a Base64 + XOR routine can be recovered and used to authenticate to LDAP directly.
Enumerating LDAP reveals a support user account whose info attribute contains a plaintext password, granting a foothold via WinRM. From there, BloodHound is used to map out the domain, revealing that the support user’s group (Shared Support Accounts) holds GenericAll rights over the Domain Controller’s computer object. This is abused via a Resource-Based Constrained Delegation (RBCD) attack, ultimately resulting in a shell as NT AUTHORITY\SYSTEM.
This is my first HTB writeup, done as part of my prep for the PJPT certification. Writing it out is helping me lock in each step of the chain not just the commands, but why each one worked and hopefully it helps someone else stuck on the same box too 😄
As with any engagement, I probably start with a full port scan to get a sense of what services are exposed and what kind of machine i am dealing with.
This scan shows a bunch of ports that are commonly found on a Windows Domain Controller things like:
- **53** DNS
- **88** Kerberos (used for authentication)
- **389 / 3268** LDAP (the directory service)
- **445** SMB (file sharing)
- **5985** WinRM (remote shell access)
Seeing this combination of ports open together is a strong sign that this machine is an Active Directory Domain Controller. The scan also leaks the domain name (`support.htb`) and the machine’s hostname (`DC`) directly from the LDAP and SMB banners so at this point I add `support.htb` to my `/etc/hosts` file and continue enumeration using the domain name instead of the raw IP.
Since port 445 was open, My next first next step is to check if anonymous (unauthenticated) access is allowed on any SMB shares a very common first foothold on beginner-friendly AD boxes.
While enumerating the SMB shares i find some interesting shares like when i see the support-tools i probably though it might be interesting so i use to look this shares than in there i found the UserInfo.exe.zip a zip file so i download on my kali to further enumerate and investigate so, maybe i get some clues if not again i will enumerate everything.
Task 1
How many shares is Support showing on SMB?
=> 6
Task 2
Which share is not a default share for a Windows domain controller?
=> support-tools
Task 3
Almost all of the files in this share are publicly available tools, but one is not. What is the name of that file?
=> UserInfo.exe.zip
Once i unzip the folder the folder contains UserInfo.exe along with several .dll files it depends on to run (standard .NET dependency libraries like System.Memory.dll, Microsoft.Extensions.DependencyInjection.dll, etc.) Since UserInfo.exe is a .NET application, its logic can be recovered almost perfectly by decompiling it back into readable C# source code:
This function shows exactly how the LDAP bind password is protected:
enc_passwordis Base64-decoded into raw bytes.- Each byte is XORed with the key
"armando"(repeated across the array). - Each byte is then XORed again with the constant
0xDF. - The resulting bytes are converted back into a plaintext string.
I used CyberChef to decrypt the password by chaining together the
same operations found in the getPassword() function.
Task 4
What is the hardcoded password used for LDAP in the UserInfo.exe binary?
=>nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
With the LDAP bind password recovered, I can now authenticate directly to the domain’s LDAP service as the `support\ldap` service account and pull information about the entire directory.
A classic AD misconfiguration is admins storing plaintext hints or passwords in an account’s info field or description so, definitely we have to go for check such field.
=> This reveals a plaintext password for the `support` user account.
Task 5
Which field in the LDAP data for the user named support stands out as potentially holding a password?
=> info
Task 6
What open port on Support allows a user in the Remote Management Users group to run PowerShell commands and get an interactive shell?
=> 5985
Get Bibash Chamling Rai’s stories in your inbox
Join Medium for free to get updates from this writer.
With a valid set of credentials (`support` / `Ironside47pleasure40Watchful`) recovered from LDAP, the next step is checking what access this account actually has. Using `crackmapexec` to test authentication across common protocols:
The `(Pwn3d!)` tag confirms this account has valid WinRM access, meaning I can get an interactive shell on the Domain Controller using evil-winrm. This gives an initial foothold on the domain controller as a
low-privileged domain user.
Now that we can enumerate using bloodhound tools which is a tool that maps Active Directory relationships and permissions to find potential attack paths. We have a foothold as a low-privileged domain user, the next step is mapping out the domain’s Active Directory structure users, groups, permissions, and potential privilege escalation paths. This doesn’t require any special privileges; **any valid domain account can be used to collect this data**, since it’s essentially just reading information that’s normally visible to authenticated users via LDAP.
This generates a set of `.json` files, which are imported into the
BloodHound GUI for visual analysis. Since BloodHound only requires
*read* access to enumerate the domain, this step works with any
authenticated account no admin privileges needed at this stage.
We have to upload all those our json files in here we can upload using quick upload and drag and drop all those json files if there is pervious data make sure to delete going in the profile database management.
This first graph is the real finding. It shows that the support user is a member of a custom group called Shared Support Accounts, and that group has been granted GenericAll rights directly over the DC.SUPPORT.HTB computer object.
GenericAll grants full control over the target object. Since the target here is a computer account, this permission enables a Resource-Based Constrained Delegation (RBCD) attack an attacker with GenericAll on a computer object can configure it to trust another computer account (one they control) to impersonate any domain user, including Administrator, when authenticating to it.
What makes this finding significant is that support holds no admin rights anywhere in the domain it’s an ordinary user account. Yet through this single GenericAll misconfiguration, it gains the practical equivalent of admin control over the DC. On a domain controller, there’s no local admin tier separate from Domain Admin, so achieving this level of control through a standard user account is a genuine privilege escalation vulnerability, not expected behavior.
Task 8
Bloodhound data will show that the support user has what privilege on the DC.SUPPORT.HTB object?
=> GenericAll
Task 9
A common attack with generic all on a computer object is to add a fake computer to the domain. What attribute on the domain sets how many computer accounts a user is allowed to create in the domain?
=> ms-ds-machineaccountquota
Now we can exploit GenericAll via RBCD attack.
With GenericAll rights over the DC.SUPPORT.HTB computer object, the attack proceeds in four steps using Impacket.
- Create a fake computer account
By default, any domain user can add up to 10 computer accounts to the domain (`ms-DS-MachineAccountQuota`). I create one to control:
2. Configure Resource-Based Constrained Delegation
Using the GenericAll rights, the DC is configured to trust the new `MARVEL$` computer account to impersonate any user when authenticating to it:
3. Request a ticket impersonating Administrator
This generates a `.ccache` file a forged Kerberos ticket, valid as `Administrator`, scoped to the `cifs` service on the DC.
4. Use the ticket to get a shell
Task 10
Following the steps for the Computer Takeover attack, eventually I get a ticket for the administrator, which Rubeus says should give administrator access in that session, but it doesn’t work. What is the name of the script from Impacket that can convert that ticket to ccache format?
=> ticketConverter.py
Task 11
What is the name of the environment variable on our local system that we’ll set to that ccache file to allow use of files like psexec.py with the -k and -no-pass options?
=> KRB5CCNAME
To get the root.txt we can find in the Administrator Desktop directory.
Conclusion
Support is a great beginner-friendly introduction to Active Directory attacks, since it walks through nearly every core AD enumeration and exploitation technique in one chain:
- Anonymous SMB access exposed a custom .NET tool (`UserInfo.exe`)
2. Decompiling the binary revealed a hardcoded, obfuscated LDAP bind password (Base64 + double-XOR)
3. Authenticated LDAP queries uncovered a plaintext password stored in a user’s `info` attribute a classic AD misconfiguration
4. That password gave a WinRM foothold as a low-privileged domain user (`support`)
5. BloodHound enumeration revealed the real vulnerability: the `support` user’s group held `GenericAll` over the domain controller’s computer object
6. This was exploited via a Resource-Based Constrained Delegation (RBCD) attack, forging a Kerberos ticket to impersonate `Administrator`
7. This resulted in a full `NT AUTHORITY\SYSTEM` shell on the domain controller complete domain compromise
Key takeaway:The entire chain started from a single exposed credential in a binary and ended in full domain admin a good reminder of how quickly small misconfigurations (hardcoded secrets, loose `info` field policies, and unnecessary `GenericAll` grants) can cascade into total compromise in an Active Directory environment.
