PingPong Writeup - HackTheBox
Insane
Windows
Discovery#
Port Scan#
┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP
[+] Discovering all open TCP ports... Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-01 19:07 +0200 Nmap scan report for 10.129.45.244 Host is up (0.013s latency). Not shown: 65515 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 2179/tcp open vmrdp 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49664/tcp open unknown 49668/tcp open unknown 49670/tcp open unknown 54929/tcp open unknown 55079/tcp open unknown 55082/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 87.09 seconds [+] Parsing open TCP ports... [+] Running scripts & versions on TCP ports: 53,88,135,139,389,445,464,593,636,2179,3268,3269,5985,9389,49664,49668,49670,54929,55079,55082 Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-01 19:09 +0200 Nmap scan report for 10.129.45.244 Host is up (0.013s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-05-02 01:09:24Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING | Not valid before: 2026-04-20T18:54:50 |_Not valid after: 2106-04-20T18:54:50 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING | Not valid before: 2026-04-20T18:54:50 |_Not valid after: 2106-04-20T18:54:50 |_ssl-date: TLS randomness does not represent time 2179/tcp open vmrdp? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING | Not valid before: 2026-04-20T18:54:50 |_Not valid after: 2106-04-20T18:54:50 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING | Not valid before: 2026-04-20T18:54:50 |_Not valid after: 2106-04-20T18:54:50 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 54929/tcp open msrpc Microsoft Windows RPC 55079/tcp open msrpc Microsoft Windows RPC 55082/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: 7h59m53s | smb2-time: | date: 2026-05-02T01:10:13 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28889.16 seconds
This is a Domain Controller for ping.htb. Sync the clock immediately to avoid Kerberos issues:
┌──(kali㉿kali)-[~]
└─$ sudo timedatectl set-ntp false
┌──(kali㉿kali)-[~]
└─$ sudo ntpdate $TARGET_IP
2026-05-02 03:10:41.447629 (+0200) +28793.511924 +/- 0.005552 10.129.45.244 s1 no-leap CLOCK: time stepped by 28793.511924
Add hosts entries:
┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP ping.htb dc01.ping.htb" | sudo tee -a /etc/hosts
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.