oscp+ active directory hacking practice, htb puppy

A medium-rated HackTheBox Active Directory machine that drills the OSCP+ fundamentals: SMB shares, LDAP enumeration, BloodHound graphing, group ACL abuse, cracking offline credential stores, and DPAPI master-key recovery.

Validate the credentials

Port scan ahead of time so you're not waiting on Nmap in the moment. Standard AD ports are open. We have an initial set of creds: levi.james / [password]. First move with credentials, always, is validate them across the AD services.

I keep this one-liner around to fan out across the common services:

WinRM rejects us. LDAP and SMB authenticate. Good enough.

Enumerate the SMB shares

Standard shares plus DEV for puppy-devs. That's the gold mine. Try to connect:

STATUS_ACCESS_DENIED. Levi isn't in puppy-devs yet. Note that for later.

Enumerate users

rusers to dump the user list:

The output formatting is ugly; this little awk pipeline cleans it up:

nxc smb puppy.htb -u levi.james -p '[password]' --rid-brute \
  | awk -F'\\\\' '/SidTypeUser/{print $2}' | awk '{print $1}'

Users include levi.james, ant.edwards, jamie.williams, steph.cooper. The box was released during NBA playoffs, so the username pattern is obvious.

LDAP dump and BloodHound

Sync clocks first or Kerberos will sulk:

Run ldapdomaindump:

Browse the HTML. We see groups: Developers, Remote Management Users. If we can land adam.silva or steph.cooper.adm, we WinRM in.

LDAP dump is good for a snapshot, but for ACLs we need BloodHound. Spin it up via Docker if you don't have it:

Collect with bloodhound-python:

Upload the JSON, mark Levi as Owned, and inspect outbound object control.

Levi → Developers (GenericWrite on group)

Levi is in HR, which has GenericWrite on the Developers group. GenericWrite on a group means we can edit its membership. Add Levi to Developers:

Verify:

Levi is now in the group. Reconnect to the DEV share:

There's a KeePass MSI installer (KeePass 2.79) and recovery.kdbx.

Crack the KeePass database

Extract a hash for Hashcat, the usual way:

But this fails: file version 40000 is currently not supported. KeePass 2.x recent versions use a format keepass2john doesn't grok yet.

Hit on entry 37 of a million: liverpool. Open the vault:

Export to CSV so we can iterate the password column:

Pull just the passwords:

awk -F',' 'NR>1 {print $4}' vault.csv | tr -d '"' > passwords.txt

Password spray and Ant Edwards

Spray the harvested passwords against every user, stop on first hit:

ant.edwards matches one of the vault passwords. Back in BloodHound: Ant-Man is a Senior Dev with GenericAll on adam.silva. adam.silva is a Remote Management User → WinRM path.

Ant Edwards → Adam Silva → WinRM

GenericAll = anything we want. Reset Adam's password:

Validate over SMB:

STATUS_ACCOUNT_DISABLED. Adam's userAccountControl flag has the disabled bit set. Since we own the account, flip it:

Now WinRM:

Shell as Adam.

Backups and DPAPI

In C:\Backups is site-backup.zip. Pull it down, unzip locally:

Inside is a config that exposes a password for steph.cooper. Validate, then:

We have winPEAS handy on our attacker box; serve it:

On the target:

The output flags DPAPI master keys and a credential file under Steph's profile. We need to decrypt them.

Encode the master key blob and the credential file as base64, exfil, decode locally:

Now Impacket's dpapi:

We get the decrypted master key. Same dance for the credential blob:

Inside: a password for steph.cooper.adm.

Domain Admin

Spray the new password just to confirm and feel good (don't do this on a real engagement, account lockouts are real):

steph.cooper.adm validates. WinRM as her:

whoami /priv shows administrator privileges. Read the flag:

Done.

Takeaways

• Validate creds across every AD service the moment you get them, not just SMB.
• ldapdomaindump for the snapshot, BloodHound for the graph. Use both.
• GenericWrite on a Group = membership manipulation. GenericAll on a User = full control.
• KeePass formats keep moving; keepass4brute is the always-works fallback.
• Disabled accounts aren't a dead end if you have GenericAll. The disable flag is just a UAC bit and you can clear it.
• DPAPI is the OSCP-grade pivot once you're shelling on a Windows host. Master key + credential file → cleartext.