# Garfield Writeup - HackTheBox

- **URL:** https://hackindex.io/writeups/garfield
- **Platform:** HackTheBox
- **Difficulty:** Hard
- **Operating system:** Windows
- **Machine:** https://hacktheboxltd.sjv.io/garfield
- **Tags:** active-directory
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Published:** 2026-03-31
- **Updated:** 2026-05-10

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT      STATE SERVICE       VERSION
# 53/tcp    open  domain        (generic dns response: SERVFAIL)
# 135/tcp   open  msrpc         Microsoft Windows RPC
# 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
# 445/tcp   open  microsoft-ds?
# 3389/tcp  open  ms-wbt-server Microsoft Terminal Services
# | rdp-ntlm-info:
# |   Target_Name: GARFIELD
# |   NetBIOS_Domain_Name: GARFIELD
# |   NetBIOS_Computer_Name: DC01
# |   DNS_Domain_Name: garfield.htb
# |   DNS_Computer_Name: DC01.garfield.htb
# |   Product_Version: 10.0.17763
# |_  System_Time: 2026-04-05T03:04:09+00:00
# | ssl-cert: Subject: commonName=DC01.garfield.htb
# 49673/tcp open  msrpc         Microsoft Windows RPC
#
# Host script results:
# | smb2-security-mode:
# |   3.1.1:
# |_    Message signing enabled and required
```

This is a Windows Server 2019 Domain Controller (`10.0.17763`). SMB signing is required ,  relay attacks are blocked. RDP NTLM info exposes the machine name `DC01` and domain `garfield.htb`. Add both to `/etc/hosts`:

```bash
echo "$TARGET_IP DC01.garfield.htb garfield.htb" >> /etc/hosts
```

### UDP Scan

```bash
scan_udp_quick $TARGET_IP
# PORT    STATE SERVICE      VERSION
# 53/udp  open  domain       (generic dns response: SERVFAIL)
# 88/udp  open  kerberos-sec Microsoft Windows Kerberos
# 123/udp open  ntp          NTP v3
# 389/udp open  ldap         Microsoft Windows Active Directory LDAP
#                            (Domain: garfield.htb, Site: Default-First-Site-Name)
```

Kerberos on 88 and LDAP on 389 confirm this is the primary DC. NTP on 123 ,  sync clocks before any Kerberos work to avoid skew errors:

```bash
sudo ntpdate $TARGET_IP
```

### Port Overview

| Port | Protocol | Service |
| --- | --- | --- |
| 53 | TCP/UDP | DNS |
| 88 | UDP | Kerberos |
| 123 | UDP | NTP |
| 135 | TCP | RPC |
| 139 | TCP | NetBIOS |
| 389 | UDP | LDAP |
| 445 | TCP | SMB (signing required) |
| 3389 | TCP | RDP |

Related

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.