jperezduerto.info
← all walkthroughs

Sizzle

Windows· Insane· Credential Access· Privilege Escalation
owned
2026-07-12
time to own
13m54s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

Target Sizzle (<retired-instance-ip>) is a Windows domain controller for HTB.LOCAL exposed directly to the Internet.

An attacker exploited anonymous SMB guest access to browse the company 'Department Shares' file share, located a publicly writable folder under Users\Public, and planted a Windows Shell Command File (.scf) that coerced a browsing domain user (amanda) into sending her NTLMv2 password hash to an attacker-controlled listener.

Hashcat cracked the hash offline and recovered her plaintext password.

Those credentials were used to enroll a user certificate from the domain's Active Directory Certificate Services through the over-permissive 'Usercert' template, and that certificate authenticated directly to Windows Remote Management over SSL, bypassing the need for the password entirely and producing an interactive PowerShell shell as amanda.

Kerberoasting from inside that session exposed the service account mrlky, whose cracked Kerberos ticket revealed credentials for an account holding directory-wide replication rights.

A single DCSync call dumped every NT hash in the domain including the Administrator's; pass-the-hash via WMI delivered a SYSTEM-level command session.

Both flags were read and the domain was fully compromised.

Attack path — how the box was taken

Mapped every exposed service on the domain controller, then Browsed company file shares as a guest and found a publicly writable folder, then Planted an SCF coercion file to capture a domain user's NTLMv2 hash, then Cracked the NTLMv2 hash offline to recover amanda's plaintext password, then Enrolled a user certificate from AD CS and opened a password-free WinRM shell as amanda, then Kerberoasted a privileged service account and cracked its ticket offline, then DCSync dumped every domain credential; pass-the-hash delivered a SYSTEM shell and the root flag.

1ReconnaissanceNetwork port and service enumeration
Mapped every exposed service on the domain controller
A full TCP port sweep of <retired-instance-ip> identified 23 open ports: FTP (21), IIS 10.0 on HTTP and HTTPS (80/443), SMB (139/445), LDAP and LDAPS (389/636), Kerberos password change (464), RPC and RPC-over-HTTP (135/593), WinRM plain and SSL (5985/5986), .NET Message Framing (9389), and over a dozen high dynamic RPC ports. LDAP banners confirmed the domain name HTB.LOCAL and Active Directory site Default-First-Site-Name. The combination of IIS on 443, Kerberos, and LDAP strongly indicated an Active Directory Certificate Services deployment, later confirmed by Certipy.
Exact commands 2
Targeted scan of standard AD and Windows service ports with version detection.
nmap -sC -sV -p 21,53,80,135,139,389,443,445,464,593,636,5985,5986,9389 --min-rate 5000 -oN sizzle-services.txt $TARGET
Full port sweep to capture the high dynamic RPC listeners (49664-49711 range).
nmap -p- --min-rate 10000 -oN sizzle-allports.txt $TARGET
2EnumerationSMB null/guest-session enumeration and share write-access testing (T1135 -- Network Share Discovery)
Browsed company file shares as a guest and found a publicly writable folder
The SMB service accepted connections from the built-in guest account with no password. Listing the 'Department Shares' share revealed subdirectories for Accounting, Audit, Banking, CEO_protected, and Devops. Testing write access against the Users\Public path succeeded: a zero-byte probe file uploaded without credentials appeared in the directory listing, confirming any unauthenticated host reachable from the Internet could plant files in a location browsed by company employees.
smbclient returned Department Shares listing authenticated as 'HTB.LOCAL/guest%'; probe file written to Users\Public confirmed with subsequent ls output.
Exact commands 1
List all shares without credentials; % means empty password.
smbclient -L //$TARGET -U '%'
3Credential CaptureSMB coercion via SCF file / Forced Authentication (T1187)
Planted an SCF coercion file to capture a domain user's NTLMv2 hash
A Windows Shell Command File (.scf) was crafted with an IconFile field referencing a UNC path on the attacker's server (\\<retired-instance-ip>\share\icon.ico). When the domain user amanda browsed Users\Public in Windows Explorer, her workstation automatically attempted to fetch the icon over SMB and sent her NTLMv2 challenge-response to the attacker. Responder, listening on the VPN interface, impersonated an SMB server, completed the challenge exchange, and captured the full NTLMv2 hash. The SCF artifact was deleted immediately after the hash was received.
Responder captured amanda's NTLMv2 challenge-response; her plaintext password [REDACTED: recovered credential] is used in every subsequent step confirming the capture.
Exact commands 1
Start Responder on the VPN interface to answer SMB challenges and capture NTLMv2 hashes; run in background before uploading the SCF.
sudo responder -I tun0 -dwv
4Credential AccessOffline NTLMv2 password cracking (T1110.002 -- Brute Force: Password Cracking)
Cracked the NTLMv2 hash offline to recover amanda's plaintext password
The NTLMv2 challenge-response saved by Responder was fed to Hashcat with the rockyou wordlist. The hash cracked quickly to the password '[REDACTED: recovered credential]', a dictionary word combined with a four-digit year. No rate-limiting or lockout applies to offline cracking, so weak passwords provide no real protection once a hash is captured. The recovered credential was immediately valid against any AD-integrated service.
hashcat recovered [REDACTED: recovered credential]; the credential authenticated successfully to Certipy and Evil-WinRM in subsequent steps.
Exact commands 1
Mode 5600 is NetNTLMv2; replace amanda.hash with the file Responder wrote the hash to (check /usr/share/responder/logs/).
hashcat -m 5600 amanda.hash /usr/share/wordlists/rockyou.txt --force
5ExploitationAD CS certificate enrollment and certificate-based WinRM authentication (T1649 -- Steal or Forge Authentication Certificates; T1021.006)
Enrolled a user certificate from AD CS and opened a password-free WinRM shell as amanda
Certipy enumerated the domain certificate authority HTB-SIZZLE-CA and found 13 enabled templates. The 'Usercert' template granted Enroll permission to all authenticated domain users. Amanda's credentials were used to request a certificate via DCOM enrollment (HTTP and RPC transports timed out). The issued certificate carried amanda's UPN (amanda@HTB.LOCAL) and was valid for Kerberos smart-card login and HTTPS client authentication. The PFX was split into a certificate and private key, then passed to Evil-WinRM for a TLS-authenticated PowerShell session on port 5986 -- no password required. The user flag was read from amanda's Desktop.
certipy req -dcom returned 'Successfully requested certificate' with UPN amanda@HTB.LOCAL; Evil-WinRM shell v3.9 confirmed with amanda session on <retired-instance-ip>:5986.
Exact commands 2
Add DNS entries required by Certipy's -target flag.
echo "$TARGET sizzle.htb.local htb.local" | sudo tee -a /etc/hosts
Extract the public certificate from the PFX (no passphrase).
openssl pkcs12 -in amanda.pfx -clcerts -nokeys -out amanda.crt -passin pass:
6Privilege EscalationKerberoasting (T1558.003 -- Steal or Forge Kerberos Tickets: Kerberoasting)
Kerberoasted a privileged service account and cracked its ticket offline
With an authenticated session in the domain, LDAP was queried for accounts with a registered Service Principal Name. The service account mrlky was the only result. A Kerberos TGS ticket for mrlky's SPN was requested from the domain controller and exported in Hashcat format. Offline cracking recovered mrlky's plaintext password. Critically, mrlky held the extended rights DS-Replication-Get-Changes and DS-Replication-Get-Changes-All in Active Directory, the same permissions assigned to domain controllers themselves.
Exact commands 1
Mode 13100 is Kerberos 5 TGS-REP etype 23 (RC4-HMAC); recovers mrlky's plaintext password.
hashcat -m 13100 mrlky.hash /usr/share/wordlists/rockyou.txt
7Domain CompromiseDCSync credential dump (T1003.006); Pass-the-Hash (T1550.002)
DCSync dumped every domain credential; pass-the-hash delivered a SYSTEM shell and the root flag
Using mrlky's cracked credentials, Impacket's secretsdump invoked the MS-DRSR directory replication API against the domain controller, impersonating a replication partner. This DCSync operation returned the NT hash for every account in HTB.LOCAL, including Administrator ([REDACTED: sensitive value]). No disk access or malware on the DC was required. Pass-the-hash via WMIExec opened a remote command session running as NT AUTHORITY\SYSTEM. Both the user and root flags were read from any matching Desktop path under C:\Users.
impacket-wmiexec -hashes [REDACTED: sensitive value]:[REDACTED: sensitive value] HTB.LOCAL/Administrator@<retired-instance-ip> executed successfully; root.txt read as Administrator confirms SYSTEM-level control.

Attack patterns used

The transferable techniques behind the compromise.

SMB null/guest-session enumeration and share write-access testingEnumerationT1135

What it is

The SMB service accepted connections from the built-in guest account with no password. Listing the 'Department Shares' share revealed subdirectories for Accounting, Audit, Banking, CEO_protected, and Devops. Testing write access against the Users\Public path succeeded: a zero-byte probe file uploaded without credentials appeared in the directory listing, confirming any unauthenticated host reachable from the Internet could plant files in a location browsed by company employees.

Why it works

Disable SMB null-session and guest enumeration via Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options): set 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' to Enabled and 'Network access: Let Everyone permissions apply to anonymous users' to Disabled. Audit all share ACLs with 'Get-SmbShare | Get-SmbShareAccess' and remove guest/Everyone write entries. Apply role-based ACLs so each department folder is accessible only to the corresponding security group. Repeat this audit quarterly.

SMB coercion via SCF file / Forced AuthenticationCredential CaptureT1187

What it is

A Windows Shell Command File (.scf) was crafted with an IconFile field referencing a UNC path on the attacker's server (\\<retired-instance-ip>\share\icon.ico). When the domain user amanda browsed Users\Public in Windows Explorer, her workstation automatically attempted to fetch the icon over SMB and sent her NTLMv2 challenge-response to the attacker. Responder, listening on the VPN interface, impersonated an SMB server, completed the challenge exchange, and captured the full NTLMv2 hash. The SCF artifact was deleted immediately after the hash was received.

Why it works

Set 'Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers' to Audit All first (to identify dependencies), then to Deny All. Enable 'Microsoft network client: Digitally sign communications (always)' and 'Microsoft network server: Digitally sign communications (always)' on all hosts via GPO to require SMB signing. Consider Windows Defender Credential Guard to protect NTLM credentials in memory. Alert on NTLM-blocked events (Event ID 8004) and deploy Microsoft Defender for Identity's 'Suspected NTLM relay attack' detection.

Offline NTLMv2 password crackingCredential AccessT1110.002

What it is

The NTLMv2 challenge-response saved by Responder was fed to Hashcat with the rockyou wordlist. The hash cracked quickly to the password '[REDACTED: recovered credential]', a dictionary word combined with a four-digit year. No rate-limiting or lockout applies to offline cracking, so weak passwords provide no real protection once a hash is captured. The recovered credential was immediately valid against any AD-integrated service.

Why it works

Deploy a Fine-Grained Password Policy (PSO) requiring a minimum of 15 characters for standard accounts and 20 for privileged accounts. Install Microsoft Entra Password Protection on-premises (free) to block dictionary words, company names, and common substitution patterns domain-wide. Mandate password manager adoption to eliminate human-chosen patterns. Consider phishing-resistant MFA (Windows Hello for Business, FIDO2 keys) for domain authentication so that a cracked password alone cannot produce a session.

AD CS certificate enrollment and certificate-based WinRM authenticationExploitationT1649

What it is

Certipy enumerated the domain certificate authority HTB-SIZZLE-CA and found 13 enabled templates. The 'Usercert' template granted Enroll permission to all authenticated domain users. Amanda's credentials were used to request a certificate via DCOM enrollment (HTTP and RPC transports timed out). The issued certificate carried amanda's UPN (amanda@HTB.LOCAL) and was valid for Kerberos smart-card login and HTTPS client authentication. The PFX was split into a certificate and private key, then passed to Evil-WinRM for a TLS-authenticated PowerShell session on port 5986 -- no password required. The user flag was read from amanda's Desktop.

Why it works

Audit every enabled template using Certipy ('certipy find -enabled -stdout') and remove the Enroll permission from 'Authenticated Users' and 'Domain Users' on every template that does not require broad enrollment. Create dedicated security groups for each template and restrict Enroll to those groups. Enable CA Manager Approval for any template whose EKUs include Client Authentication or Smart Card Logon. Enable certificate issuance audit logging (Event ID 4886/4887) and alert on unexpected template usage. Validate all templates against the ESC1 through ESC13 misconfiguration checklist documented in the SpecterOps Certified Pre-Owned research.

KerberoastingPrivilege EscalationT1558.003

What it is

With an authenticated session in the domain, LDAP was queried for accounts with a registered Service Principal Name. The service account mrlky was the only result. A Kerberos TGS ticket for mrlky's SPN was requested from the domain controller and exported in Hashcat format. Offline cracking recovered mrlky's plaintext password. Critically, mrlky held the extended rights DS-Replication-Get-Changes and DS-Replication-Get-Changes-All in Active Directory, the same permissions assigned to domain controllers themselves.

Why it works

Immediately identify and remove DS-Replication-Get-Changes and DS-Replication-Get-Changes-All from all non-DC accounts (check with BloodHound or 'Get-ADObject -Filter {ObjectClass -eq "domain"} | Get-Acl'). Migrate mrlky and all other SPN-registered services to Group Managed Service Accounts (gMSA): Active Directory automatically rotates gMSA passwords to 240 random characters, making Kerberoasting infeasible. On all remaining service accounts, enable 'This account supports Kerberos AES encryption only' to force AES-256 TGS issuance and defeat RC4-downgrade attacks used by Kerberoasting tools. Enable auditing and alert on Event ID 4662 with replication GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 or 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 to detect unauthorized DCSync calls in real time.

Findings

Disable SMB guest access and remove unauthenticated write permissions from company sharesHigh
The 'Department Shares' SMB share was fully browsable by the built-in guest account with no password, and the Users\Public subdirectory accepted write operations from that same unauthenticated session. Any host on the Internet could enumerate the share layout and plant files visible to employees.
Block outbound NTLM to untrusted hosts and require SMB signing to prevent coercion-based hash captureHigh
Windows workstations automatically sent an NTLMv2 challenge-response to an arbitrary attacker-controlled IP when a user browsed a folder containing an SCF file with a UNC icon path. SMB signing was not enforced and outbound NTLM was unrestricted, so Responder could record a crackable hash from any domain user who browsed the public share.
Enforce a strong, non-dictionary password policy for all domain accountsMedium
Amanda's password ('[REDACTED: recovered credential]') was a common dictionary word combined with a four-digit year. Once her NTLMv2 hash was captured, Hashcat cracked it against the rockyou wordlist in seconds. No online lockout or rate limit applies to offline cracking, so any hash that leaves the domain is as secure as the password itself.
Restrict AD CS certificate template enrollment to authorized identities onlyCritical
The 'Usercert' certificate template on HTB-SIZZLE-CA granted the Enroll right to all authenticated domain users. Any compromised domain account could request a certificate valid for Kerberos smart-card login and WinRM SSL client authentication, giving the attacker a persistent, password-independent credential that survives a password reset.
Remove DCSync rights from service accounts and eliminate Kerberoastable privileged identitiesCritical
The service account mrlky had a registered Service Principal Name, making it Kerberoastable by any authenticated domain user, and simultaneously held DS-Replication-Get-Changes-All, the extended right normally reserved for domain controllers. A single cracked Kerberos ticket therefore unlocked complete domain credential theft via DCSync -- every account in the domain was compromised from one weak service-account password.

Exposed services

External surface