# Scaffold Writeup - HackTheBox

> Hard Windows box involving complex exploitation chain with service enumeration, privilege escalation, and advanced attack techniques to achieve full system compromise.

- **URL:** https://hackindex.io/writeups/scaffold
- **Platform:** HackTheBox
- **Difficulty:** Hard
- **Operating system:** Windows
- **Machine:** https://app.hackthebox.com/machines/Scaffold?tab=play_machine
- **Tags:** xxe, active-directory, bloodhound
- **Access:** Partly password protected
- **Authors:** [Khant-Nyar](https://hackindex.io/authors/khant-nyar.md)
- **Read time:** 4 min read
- **Published:** 2026-08-22
- **Updated:** 2026-09-11

```bash
nmap -Pn -p- --min-rate 2500 -oA scans/all-tcp $TARGET_IP
nmap -Pn -sCV -p53,80,88,135,139,389,443,445,464,593,636,3268,3269,5040,5985,9389,9800,9801,47001 $TARGET_IP -oA scans/focused
# PORT     STATE SERVICE
# 53/tcp   open  domain
# 80/tcp   open  http         Microsoft IIS
# 88/tcp   open  kerberos-sec
# 389/tcp  open  ldap
# 443/tcp  open  https        Scaffold Portal (NTLM)
# 445/tcp  open  microsoft-ds
# 5040/tcp open  unknown      WDS Control Protocol
# 5985/tcp open  http         WinRM
# 9800/tcp open  unknown      MDT Monitor Event service
# 9801/tcp open  unknown      MDT Monitor OData service
# 47001/tcp open  http        WinRM
```

Would you like to solve this machine together? Join our discord and/or our [open HTB team!](https://app.hackthebox.com/public/teams/8368)

Domains: **scaffold.htb**, **dc.scaffold.htb**, **portal.scaffold.htb**

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.