Pirate Writeup - HackTheBox
Hard
Windows
Discovery
Reading the box its description reveals us the begin credentials:
As is common in real life pentests, you will start the Pirate box with credentials for the following account pentest / p3nt3st2025!&We will also start a full nmap scan:
┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP
Nmap done: 1 IP address (1 host up) scanned in 104.93 seconds [+] Parsing open TCP ports... [+] Running scripts & versions on TCP ports: 53,80,88,135,139,389,443,445,464,593,636,2179,3268,3269,5985,9389,49667,49677,49678,49680,49681,49905,49928,49952 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-28 20:04 +0100 Nmap scan report for $TARGET_IP Host is up (0.018s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-01 02:04:33Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-03-01T02:06:48+00:00; +7h00m03s from scanner time. | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 |_Not valid after: 2026-06-09T14:05:15 443/tcp open https? 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-03-01T02:06:48+00:00; +7h00m03s from scanner time. | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 |_Not valid after: 2026-06-09T14:05:15 2179/tcp open vmrdp? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 |_Not valid after: 2026-06-09T14:05:15 |_ssl-date: 2026-03-01T02:06:48+00:00; +7h00m03s from scanner time. 3269/tcp open globalcatLDAPssl? | ssl-cert: Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 |_Not valid after: 2026-06-09T14:05:15 |_ssl-date: 2026-03-01T02:06:49+00:00; +7h00m03s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open unknown 49677/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49678/tcp open unknown 49680/tcp open unknown 49681/tcp open unknown 49905/tcp open unknown 49928/tcp open unknown 49952/tcp open unknown Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2026-03-01T02:04:54 |_ start_date: N/A |_clock-skew: mean: 7h00m02s, deviation: 0s, median: 7h00m02s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 142.73 seconds
Together with a UDP scan:
┌──(kali㉿kali)-[~]
└─$ scan_udp_quick $TARGET_IP
[+] Discovering common UDP ports... Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-28 20:02 +0100 Nmap scan report for $TARGET_IP Host is up (0.013s latency). Not shown: 196 open|filtered udp ports (no-response) PORT STATE SERVICE 53/udp open domain 88/udp open kerberos-sec 123/udp open ntp 389/udp open ldap Nmap done: 1 IP address (1 host up) scanned in 4.20 seconds [+] Parsing open UDP ports... [+] Light UDP service detection on: 53,88,123,389 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-28 20:02 +0100 Nmap scan report for $TARGET_IP Host is up (0.013s latency). PORT STATE SERVICE VERSION 53/udp open domain (generic dns response: SERVFAIL) 88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-01 02:02:45Z) 123/udp open ntp NTP v3 389/udp open ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 25.90 seconds
Add the new found domain to our /etc/hosts:
┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP pirate.htb
And we also sync our machine clock to the NTP service:
┌──(kali㉿kali)-[~]
└─$ sudo timedatectl set-ntp false
┌──(kali㉿kali)-[~]
└─$ sudo ntpdate $TARGET_IP
2026-03-01 03:18:04.420233 (+0100) +25202.626509 +/- 0.005668 $TARGET_IP s1 no-leap CLOCK: time stepped by 25202.626509
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.