Garfield Writeup - HackTheBox
Hard
Windows
Discovery
Port Scan
┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP
PORT STATE SERVICE VERSION 53/tcp open domain (generic dns response: SERVFAIL) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: GARFIELD | NetBIOS_Domain_Name: GARFIELD | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: garfield.htb | DNS_Computer_Name: DC01.garfield.htb | Product_Version: 10.0.17763 |_ System_Time: 2026-04-05T03:04:09+00:00 | ssl-cert: Subject: commonName=DC01.garfield.htb 49673/tcp open msrpc Microsoft Windows RPC Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required
This is a Windows Server 2019 Domain Controller (10.0.17763). SMB signing is required — relay attacks are blocked. RDP NTLM info exposes the machine name DC01 and domain garfield.htb. Add both to /etc/hosts:
┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP DC01.garfield.htb garfield.htb" >> /etc/hosts
UDP Scan
┌──(kali㉿kali)-[~]
└─$ scan_udp_quick $TARGET_IP
PORT STATE SERVICE VERSION
53/udp open domain (generic dns response: SERVFAIL)
88/udp open kerberos-sec Microsoft Windows Kerberos
123/udp open ntp NTP v3
389/udp open ldap Microsoft Windows Active Directory LDAP
(Domain: garfield.htb, Site: Default-First-Site-Name)
Kerberos on 88 and LDAP on 389 confirm this is the primary DC. NTP on 123 — sync clocks before any Kerberos work to avoid skew errors:
┌──(kali㉿kali)-[~]
└─$ sudo ntpdate $TARGET_IP
Port Overview
Port | Protocol | Service |
|---|---|---|
53 | TCP/UDP | DNS |
88 | UDP | Kerberos |
123 | UDP | NTP |
135 | TCP | RPC |
139 | TCP | NetBIOS |
389 | UDP | LDAP |
445 | TCP | SMB (signing required) |
3389 | TCP | RDP |
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.