Checkpoint

Hack The Box · app.hackthebox.com/machines/Checkpoint

Windows Medium Season 11 Active Directory User Root ● Completed writeup after season

Summary A modern Active Directory box on Windows Server 2025, played as an assumed breach from a single low-privileged credential. Full domain compromise came from chaining five distinct weaknesses: over-broad AD object permissions, a software supply-chain path through an auto-installing VS Code extension share, a patched-but-still-abusable dMSA migration primitive, a VMware memory image sitting on a backup share, and local Administrator password reuse across the estate.

01Why the full writeup is held back

Checkpoint is a live Season 11 machine, so in line with Hack The Box's guidance on active machines I am not publishing a step-by-step reproduction, commands, credentials or flags. The complete walkthrough, covering the enumeration, the foothold chain, the privilege-escalation path and the client-style remediation plan, goes live here once the season closes.

02The interesting bits (no spoilers)

Object rights as a chain, not a single bug

The foothold began with a permission most people would rate as low risk on its own: the ability to revive a deleted account. Because a restored tombstone keeps its old secrets, and that account had write access somewhere it should not have, a moderate right became the first link in a chain to code execution.

A software supply-chain path

Execution arrived through a developer workflow rather than a classic exploit: a share that automatically installed VS Code extensions ran attacker-supplied code. It is a sharp reminder that any location which auto-executes packages is production infrastructure and needs signing, scanning and approval.

A patched primitive that was not eliminated

The privilege escalation abused a delegated Managed Service Account (dMSA) migration path in the "BadSuccessor" family (CVE-2025-53779 class). The domain controller was patched, but the technique still worked because it was possible to control both sides of the successor relationship. A patch narrows a technique; it does not always remove it.

Memory images are credential stores

A backup share held a VMware memory snapshot. Treating it as a forensic artefact and running Volatility against it recovered a local Administrator hash. That hash was reused by the domain Administrator, so an offline file turned into full domain compromise via Pass-the-Hash.

Operational realism

Two problems looked like exploit failures but were not: a VPN path-MTU black hole that stalled large transfers, and Kerberos clock skew. Recognising infrastructure issues for what they are, rather than blaming the technique, is half the battle on AD boxes.

03Takeaways

Evaluate AD object rights as a chain. A moderate permission on one object can become critical when combined with creation or write rights elsewhere.
A patch is not always the end of a technique. Patched BadSuccessor still worked given control of both ends of the migration link; detection matters alongside patching.
Treat backups and memory snapshots as Tier 0. VMEM, VMSS and hibernation files can contain hashes, Kerberos material and live secrets.
Kill password reuse. Local-to-domain Administrator reuse is what converted an offline hash into a domain takeover; LAPS and unique service credentials break the chain.
Straight into the day job: detection logic for dMSA and msDS-Superseded* changes, tombstone restores, unexpected extension installs, backup downloads and Pass-the-Hash, plus a Windows Server 2025 / DISA STIG hardening baseline.

Coming after Season 11 Full technical walkthrough with the enumeration, the tombstone-to-foothold chain, the dMSA BadSuccessor escalation, the memory-image extraction, and a prioritised remediation and hardening plan.

back to writeups