# PingPong Writeup - HackTheBox

> Insane Windows box exploiting a ping command injection vulnerability, chaining SSRF and lateral movement techniques to achieve full system compromise.

- **URL:** https://hackindex.io/writeups/pingpong
- **Platform:** HackTheBox
- **Difficulty:** Insane
- **Operating system:** Windows
- **Machine:** https://hacktheboxltd.sjv.io/pingpong
- **Tags:** command-injection, ssrf, active-directory
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md), [Benslates](https://hackindex.io/authors/benslates.md)
- **Published:** 2026-04-28
- **Updated:** 2026-08-10

## **Discovery[#](https://hackindex.io/writeups/logging#discovery)**

### **Port Scan[#](https://hackindex.io/writeups/logging#port-scan)**

```bash
scan_tcp_full $TARGET_IP  
# [+] Discovering all open TCP ports...
# Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-01 19:07 +0200
# Nmap scan report for 10.129.45.244
# Host is up (0.013s latency).
# Not shown: 65515 filtered tcp ports (no-response)
# Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
# PORT      STATE SERVICE
# 53/tcp    open  domain
# 88/tcp    open  kerberos-sec
# 135/tcp   open  msrpc
# 139/tcp   open  netbios-ssn
# 389/tcp   open  ldap
# 445/tcp   open  microsoft-ds
# 464/tcp   open  kpasswd5
# 593/tcp   open  http-rpc-epmap
# 636/tcp   open  ldapssl
# 2179/tcp  open  vmrdp
# 3268/tcp  open  globalcatLDAP
# 3269/tcp  open  globalcatLDAPssl
# 5985/tcp  open  wsman
# 9389/tcp  open  adws
# 49664/tcp open  unknown
# 49668/tcp open  unknown
# 49670/tcp open  unknown
# 54929/tcp open  unknown
# 55079/tcp open  unknown
# 55082/tcp open  unknown
#
# Nmap done: 1 IP address (1 host up) scanned in 87.09 seconds
# [+] Parsing open TCP ports...
# [+] Running scripts & versions on TCP ports: 53,88,135,139,389,445,464,593,636,2179,3268,3269,5985,9389,49664,49668,49670,54929,55079,55082
# Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-01 19:09 +0200
# Nmap scan report for 10.129.45.244
# Host is up (0.013s latency).
#
# PORT      STATE SERVICE       VERSION
# 53/tcp    open  domain        Simple DNS Plus
# 88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-05-02 01:09:24Z)
# 135/tcp   open  msrpc         Microsoft Windows RPC
# 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
# 389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
# |_ssl-date: TLS randomness does not represent time
# | ssl-cert: Subject: 
# | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
# | Not valid before: 2026-04-20T18:54:50
# |_Not valid after:  2106-04-20T18:54:50
# 445/tcp   open  microsoft-ds?
# 464/tcp   open  kpasswd5?
# 593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
# 636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
# | ssl-cert: Subject: 
# | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
# | Not valid before: 2026-04-20T18:54:50
# |_Not valid after:  2106-04-20T18:54:50
# |_ssl-date: TLS randomness does not represent time
# 2179/tcp  open  vmrdp?
# 3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
# |_ssl-date: TLS randomness does not represent time
# | ssl-cert: Subject: 
# | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
# | Not valid before: 2026-04-20T18:54:50
# |_Not valid after:  2106-04-20T18:54:50
# 3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: ping.htb, Site: Default-First-Site-Name)
# |_ssl-date: TLS randomness does not represent time
# | ssl-cert: Subject: 
# | Subject Alternative Name: DNS:dc1.ping.htb, DNS:ping.htb, DNS:PING
# | Not valid before: 2026-04-20T18:54:50
# |_Not valid after:  2106-04-20T18:54:50
# 5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
# |_http-title: Not Found
# |_http-server-header: Microsoft-HTTPAPI/2.0
# 9389/tcp  open  mc-nmf        .NET Message Framing
# 49664/tcp open  msrpc         Microsoft Windows RPC
# 49668/tcp open  msrpc         Microsoft Windows RPC
# 49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
# 54929/tcp open  msrpc         Microsoft Windows RPC
# 55079/tcp open  msrpc         Microsoft Windows RPC
# 55082/tcp open  msrpc         Microsoft Windows RPC
# Service Info: Host: DC1; OS: Windows; CPE: cpe:/o:microsoft:windows
#
# Host script results:
# | smb2-security-mode: 
# |   3.1.1: 
# |_    Message signing enabled and required
# |_clock-skew: 7h59m53s
# | smb2-time: 
# |   date: 2026-05-02T01:10:13
# |_  start_date: N/A
#
# Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done: 1 IP address (1 host up) scanned in 28889.16 seconds
#
```

This is a Domain Controller for `ping.htb`. Sync the clock immediately to avoid Kerberos issues:

```bash
sudo timedatectl set-ntp false
sudo ntpdate $TARGET_IP
# 2026-05-02 03:10:41.447629 (+0200) +28793.511924 +/- 0.005552 10.129.45.244 s1 no-leap
# CLOCK: time stepped by 28793.511924
```

Add hosts entries:

```bash
echo "$TARGET_IP ping.htb dc01.ping.htb" | sudo tee -a /etc/hosts
```

Related

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.