Checkpoint Writeup - HackTheBox
Medium
Windows
Last updated July 14, 2026 • 7 min read
Reconnaissance
┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p- --min-rate 5000 -oN nmap_full.txt $TARGET_IP
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: checkpoint.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open mc-nmf .NET Message Framing | ssl-cert: Subject: commonName=DC01.checkpoint.htb Host script results: | NetBIOS name: DC01 | DNS_Domain_Name: checkpoint.htb | DNS_Computer_Name: DC01.checkpoint.htb
Classic DC fingerprint: DNS (53), Kerberos (88), LDAP (389/3268), SMB (445), WinRM (5985). Domain checkpoint.htb, hostname DC01.checkpoint.htb from LDAP + SSL cert.
/etc/hosts
┌──(kali㉿kali)-[~]
└─$ echo '$TARGET_IP checkpoint.htb dc01.checkpoint.htb dc01' | sudo tee -a /etc/hosts
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.