Administrator — HTB (10.10.11.42)

Medium Windows AD box (HTB). Full-domain-compromise scenario starting from a low-priv credential, walking an ACL chain across users to DCSync.

Synopsis

Administrator is a medium-difficulty Windows machine designed around a complete domain compromise, where credentials for a low-privileged user are provided. The attack chain:

1. olivia → michael — enumerate ACLs over privileged objects; olivia has GenericAll over michael, so reset his password.
2. michael → benjamin — michael can force a password change on benjamin; reset it.
3. benjamin → FTP loot — access FTP as benjamin, find a backup.psafe3 (Password Safe) file.
4. Crack the safe — cracking backup.psafe3 reveals credentials for several users.
5. Spray → emily — password-spray the recovered creds; valid for emily.
6. emily → ethan — emily has GenericWrite over ethan → targeted Kerberoasting; crack the recovered hash for ethan's password.
7. ethan → Domain Admin — ethan has DCSync rights → dump the Administrator NTLM hash → full domain compromise.

Information Gathering

Standard AD service surface (Kerberos 88, LDAP 389/3268, SMB 445, etc.). Begin with BloodHound after the provided low-priv creds to map the ACL paths above.

Key techniques

• ACL abuse: GenericAll / GenericWrite (force password reset, targeted Kerberoast)
• Password Safe (.psafe3) cracking
• Password spraying
• Kerberoasting
• DCSync for the domain Administrator hash