Skip to content

Scaffold Writeup - HackTheBox

Hard Windows

Created August 22, 2026 • Last updated September 11, 2026 • 4 min read

Khant-Nyar

Pentester, Learner, Builder

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p- --min-rate 2500 -oA scans/all-tcp $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sCV -p53,80,88,135,139,389,443,445,464,593,636,3268,3269,5040,5985,9389,9800,9801,47001 $TARGET_IP -oA scans/focused
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http         Microsoft IIS
88/tcp   open  kerberos-sec
389/tcp  open  ldap
443/tcp  open  https        Scaffold Portal (NTLM)
445/tcp  open  microsoft-ds
5040/tcp open  unknown      WDS Control Protocol
5985/tcp open  http         WinRM
9800/tcp open  unknown      MDT Monitor Event service
9801/tcp open  unknown      MDT Monitor OData service
47001/tcp open  http        WinRM

Would you like to solve this machine together? Join our discord and/or our open HTB team!

Domains: scaffold.htb, dc.scaffold.htb, portal.scaffold.htb

Join the HackIndex community

Share writeups, ask questions, and stay current with techniques. Over 850 members.

Join Discord (opens in new tab)

Protected Writeup

This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.