Administrator HTB
Administrator Box Summary Administrator is a medium-difficulty Active Directory machine focused on abusing delegated permissions and object control relationships. Starting with a low-privileged domain account, BloodHound reveals a chain of privileges that allows us to progressively compromise multiple users by abusing GenericWrite and ForceChangePassword permissions. Along the way, an FTP share exposes a Password Safe database containing additional credentials, ultimately leading to WinRM access on the Domain Controller. Further BloodHound analysis reveals a path to perform a targeted Kerberoasting attack against another user, whose compromised account possesses replication privileges. These privileges are then abused to perform a DCSync attack, allowing extraction of the Domain Administrator hash and resulting in full compromise of the domain. Attack Overview Starting with the provided credentials for Olivia, BloodHound revealed a GenericWrite privilege over michael, allowing a password reset and access to the account. Michael's account had ForceChangePassword rights over benjamin, whose FTP access exposed a Password Safe database containing additional domain credentials. One of those credentials provided WinRM access as emily, who had GenericWrite permissions over ethan. By abusing this privilege through a targeted Kerberoasting attack, we recovered Ethan's password and gained access to his account. Finally, Ethan possessed DCSync privileges, allowing extraction of the Domain Administrator hash and full compromise of the Domain Controller through Pass-the-Hash. Enumeration Nmap Scanning Starting with an Nmap scan against the target. Nmap Analysis The scan reveals a typical Active Directory Domain Controller. Interesting services include: | Port | Service | |--------|---------| | 21 | FTP | | 88 | Kerberos | | 389 | LDAP | | 445 | SMB | | 5985 | WinRM | The LDAP banner reveals the domain: Adding the domain to /etc/hosts: HTB provides us with an initial set of credentials: Let's see what access we have. SMB Enumeration Enumerating available SMB shares: Unfortunately, we don't have access to any interesting shares. At this point there isn't much we can do through SMB, so the next step is to collect BloodHound data and look for Active Directory attack paths. --- BloodHound Enumeration Collecting BloodHound data: After importing the data into BloodHound and marking Olivia as owned, an interesting relationship appears. image BloodHound shows: Since we have GenericWrite over Michael, the easiest option is to reset his password. Compromising Michael Using BloodyAD: Awesome. We now control: Marking Michael as owned inside BloodHound reveals another interesting relationship. image Michael has: Let's continue following the chain. Compromising Benjamin Resetting Benjamin's password: We now have: At first glance, BloodHound does not reveal any further outbound object control from Benjamin. However, it is always worth checking what services the user can access. FTP Access Testing Benjamin's credentials against FTP: Interesting. Benjamin has FTP access. Connecting to the server: Listing files: A single file stands out: Let's download it. Password Safe Database Checking the file type: Interesting. This appears to be a Password Safe vault. Trying to open it immediately prompts for a password. Rather than guessing, let's extract the hash and crack it offline. Cracking the Vault Password Generating a hash using pwsafe2john: Now cracking it with John: The vault password is: Recovering Stored Credentials Opening the Password Safe database with the recovered password reveals multiple stored credentials. image After copying the entries, we recover: Awesome. We now have three additional sets of credentials that need to be validated against the domain. Credential Validation Now that we have recovered several credentials from the Password Safe vault, let's validate them against the domain. I saved the usernames and passwords into separate files: Testing all combinations using NetExec: Awesome. We have one valid credential pair: WinRM Access Let's check whether Emily has WinRM access. Perfect. We can now log into the box. Connecting with Evil-WinRM: Success. We now have our first shell on the target. User Flag Reading the user flag: Privilege Escalation After marking emily as owned in BloodHound, another interesting relationship appears. image BloodHound reveals: This is a very interesting privilege. Instead of resetting Ethan's password, we can use GenericWrite to add an SPN and temporarily perform a targeted Kerberoasting attack. Targeted Kerberoasting The easiest way to abuse this is with targetedKerberoast.py. Repository: Before running the attack, synchronize the system time to avoid Kerberos issues. Now execute the attack: Perfect. All we need to do now is crack the hash. Cracking Ethan's Password Saving the hash into a file: Cracking it with John: Success. We have recovered Ethan's password: Validating Ethan's Credentials Testing the credentials: The credentials are valid. After marking Ethan as owned inside BloodHound, another interesting privilege becomes visible. image Unlike previous users, Ethan has enough privileges to perform a DCSync attack. DCSync Attack Using Impacket's SecretsDump: Beautiful. The most important hash is: At this point, the box is effectively compromised. Administrator Shell Using Pass-the-Hash with Evil-WinRM: Output: Success. We now have Administrator access on the Domain Controller. Root Flag Reading the final flag: And with that, the machine is fully compromised. Final Thoughts Administrator was a straightforward but enjoyable Active Directory machine that focused heavily on understanding and abusing delegated permissions within the domain. Rather than relying on complex exploitation techniques, the box rewarded careful BloodHound analysis and the ability to identify how individual permissions could be chained together into a complete attack path. The progression felt very natural, moving from GenericWrite, to ForceChangePassword, to credential discovery through FTP, and finally into targeted Kerberoasting. Each step provided just enough access to reach the next user, making the attack path easy to follow while still requiring a solid understanding of Active Directory privilege relationships. My favorite part of the machine was the targeted Kerberoasting attack against ethan. It's a technique that doesn't appear as often as traditional Kerberoasting and serves as a great example of how seemingly harmless permissions like GenericWrite can quickly lead to credential compromise. Overall, Administrator is an excellent machine for learning BloodHound, ACL abuse, targeted Kerberoasting, and DCSync attacks. If you're looking to strengthen your understanding of Active Directory privilege escalation and attack path analysis, this box is definitely worth completing. Hope you enjoyed the write-up, and I'll see you in the next one! ```