Windows on z3r0s

Herald

Sun, 10 May 2026 00:00:00 +0000

Nmap Scan

[12ms][127][~/herald]$ nmap -sCV 10.0.12.3
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-13 17:45 -0400
Stats: 0:00:50 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.95% done; ETC: 17:46 (0:00:00 remaining)
Nmap scan report for herald.htb (10.0.12.3)
Host is up (0.00091s latency).
Not shown: 986 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-04-13 21:45:30Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: herald.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info: 
| 10.0.12.3:1433: 
| Version: 
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_ssl-date: 2026-04-13T21:46:08+00:00; -3s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-04-13T21:42:38
|_Not valid after: 2056-04-13T21:42:38
| ms-sql-ntlm-info: 
| 10.0.12.3:1433: 
| Target_Name: HERALD
| NetBIOS_Domain_Name: HERALD
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: herald.htb
| DNS_Computer_Name: DC01.herald.htb
| DNS_Tree_Name: herald.htb
|_ Product_Version: 10.0.17763
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: herald.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
MAC Address: 08:00:27:0F:D0:78 (Oracle VirtualBox virtual NIC)
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
| 3.1.1: 
|_ Message signing enabled and required
|_clock-skew: mean: 0s, deviation: 3s, median: 1s
| smb2-time: 
| date: 2026-04-13T21:45:35
|_ start_date: N/A
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:0f:d0:78 (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 61.04 seconds

add in etc/hosts

HTB - Pirate

Sun, 26 Apr 2026 00:00:00 +0000

Field	Value
Difficulty	Hard
OS	Windows (Active Directory)
Domain	PIRATE.HTB

Summary Link to heading

Pirate is a Hard-rated multi-host Windows Active Directory machine simulating a realistic corporate environment with three domain-joined machines. The attack chains six distinct AD primitives with no CVEs required - every step exploits misconfigurations:

Pre-Windows 2000 Compatible Access (MS01$ machine account auth) → gMSA password extraction via LDAP → Pass-the-Hash over WinRM on DC01 → L3 network pivot via Ligolo-ng to the internal 192.168.100.0/24 subnet → NTLM relay to LDAPS with RBCD to gain WEB01 Administrator → user flag → SPN injection with Constrained Delegation abuse to impersonate Domain Admin on DC01 → root flag.

HTB - PingPong

Sun, 19 Apr 2026 00:00:00 +0000

Difficulty: Insane
OS: Windows
Points: 50
Release: 2026-04-27
Starting Creds: c.roberts / AssumedBreach123

Attack Chain Link to heading

c.roberts (PING.HTB)
 → ESC13 (TemporaryWinRM) → PKINIT TGT + TempWinRMAccess SID → WinRM on DC1
 → Ligolo-ng tunnel → DC2 reachable (192.168.2.2)
 → WriteDACL on gMSA Managers (PONG) → GenericAll → scope flip (Global→Universal→DomainLocal)
 → Add cross-forest FSP → ReadGMSAPassword → Pong_gMSA$ NTLM/AES
 → JEA endpoint on DC1 (restricted) → PSReadLine history → c.carlssen / A()DUJ!@414
 → WinRM on DC2 → user.txt
 → c.carlssen GenericWrite on svc_sql → RBCD (Pong_gMSA$ → svc_sql)
 → S4U2Proxy impersonate c.adam → MSSQL xp_cmdshell → local admin on DC2
 → c.carlssen → Domain Admins (PONG) → DCSync → R.Martinelli
 → R.Martinelli ∈ CA Managers (PING) → ESC4 on SmartcardAuthentication → ESC1
 → cert for Administrator@ping.htb → PKINIT → root.txt on DC1

Recon Link to heading

Classic Windows DC port profile: 53, 88, 135, 389, 445, 464, 636, 3268, 3269, 5985, 9389

HTB - Logging

Sun, 12 Apr 2026 00:00:00 +0000

Overview Link to heading

Field	Value
OS	Windows Server 2019
Difficulty	Hard
IP	10.129.X.X
Domain	logging.htb
DC	dc01.logging.htb

Attack Chain: Anonymous SMB → Credentials in Logs → Shadow Credentials (gMSA) → WinRM → DLL Hijack → Domain User Shell → ESC17 (ADCS + WSUS MitM) → SYSTEM

1. Reconnaissance Link to heading

Port Scan Link to heading

rustscan -a 10.129.X.X --ulimit 5000 -- -sV

Key open ports:

HTB - Garfield

Sun, 22 Mar 2026 00:00:00 +0000

Difficulty: Hard | Platform: Windows Active Directory | Category: Seasonal
Tags: active-directory smb kerberos rbcd rodc golden-ticket keylist mimikatz rubeus

Machine Info Link to heading

Field	Details
Machine Name	Garfield
IP Address	10.129.27.196 (initial) / 10.129.23.120 (reset)
OS	Windows Server 2019 (Domain Controller)
Domain	garfield.htb (GARFIELD.HTB)
Difficulty	Hard
Starting Creds	`j.arbuckle / Th1sD4mnC4t!@1978`

1. Executive Summary Link to heading

Garfield is a Hard-rated Windows Active Directory machine on Hack The Box's seasonal lineup. It simulates a real-world corporate AD environment with multiple chained vulnerabilities spanning SMB misconfigurations, AD ACL abuse, logon script hijacking, RBCD (Resource-Based Constrained Delegation) attacks, Read-Only Domain Controller (RODC) compromise, and a KeyList attack to retrieve the main DC's Administrator hash - ultimately achieving full domain compromise.