search
WINDOWS & ADABOUT ME
HackTheBoxActiveDirectoryWindowsVulnLabs

Timelapse

another easy AD box on HTB

nmap revealed the following port 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, 5986, 9389, 49667, 49674, 49693, 53255 when querying for service and version information it returns

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-02-28 21:52:28Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5986/tcp  open  ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| ssl-cert: Subject: commonName=dc01.timelapse.htb
| Not valid before: 2021-10-25T14:05:29
|_Not valid after:  2022-10-25T14:25:29
| tls-alpn: 
|_  http/1.1
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
|_ssl-date: 2026-02-28T22:03:30+00:00; +7h59m59s from scanner time.
9389/tcp  open  mc-nmf   .NET Message Framing
49667/tcp open  msrpc    Microsoft Windows RPC
49674/tcp open  msrpc    Microsoft Windows RPC
49693/tcp open  msrpc    Microsoft Windows RPC
53255/tcp open  msrpc    Microsoft Windows RPC

we can access smb with anonymous access. In SMB, there is a share called Shares, in Shares\Dev there is a file called winrm_backup.zip(from my experience, it would probably be of a cer).

After moving it to my system, I realized it was password-protected, so first I extracted its hash using

now crack it using johntheripper, using

cracked hash revealed the password to be "supremelegacy". Inside this zip file there was a legacyy_dev_auth.pfx, which was again password protected. I extracted it's hash using

and cracked the password using

Now I extracted the private key file using

and entered the password "thuglegacy" when prompted now we can easily get a shell using this key file and Evil-WinRM using

Now checking the powershell history using

we get

this gave us username and password svc_deploy:E3R$Q62^12p7PLlC%KWaxuaV now using these credentials. We will login Evil-Winrm

Using net user svc_deploy we can see that svc_deploy is a part of LAPS_Readers group (LAPS is used to manage local account passwords of AD computers). Using AdmPwd.PSarrow-up-right we can exploit LAPS rights and and get the clear text password. To first see which objects can be managed by LAPS we can use the following command

it gives us

Now we will get the clear-text password using

It gives us the password and using that password in Evil-WinRM we can easily get the root flag

PreviousForestNextActive

Last updated