HackTheBox

Overview Absolute is an Insane Windows machine from HackTheBox created by Geiseric. This machine starts off with discovering usernames in the Author field of metadata from images on the website. Making a wordlist out of these and using kerbrute reveals valid usernames. I’ll AS-REP roast these users to get one hit, and the hash from the AS-REP Roast cracks. Every user is in the Protected Users group so we have to get a TGT for all users and go through kerberos with every tool. After some LDAP enumeration I find another users password set in their description. Using that user I can grab an exe file which attempts to authenticate to LDAP at dc.absolute.htb, so I point that FQDN to my attacker machine and I capture the creds via Responder. This user has permissions to grant himself GenericAll to a group that has GenericWrite to a user that can WinRM, so I abuse this via bloodyAD and certipy-ad to get the NT hash of winrm_user, then I WinRM to obtain the user flag. For root some basic...

Overview Support is an easy HTB machine created by 0xdf which starts with Reverse Engineering a PE file found in an SMB share to recover encrypted credentials. Then some LDAP enumeration to find a users password in a custom LDAP attribute. For root you exploit RBCD to the DC to impersonate Administrator, then you can dump all of the NT hashes to WinRM for the root flag. Nmap ScanI’ll run nmap on all open TCP ports: 12345678910111213141516171819202122232425262728293031323334353637383940414243💫 ~/htb/Support/enumeration ➜ nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -sCV -vvvv 10.10.11.174Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-13 03:41 EDTNSE: Loaded 157 scripts for scanning.NSE: Script Pre-scanning.NSE: Starting runlevel 1 (of 3) scan.Initiating NSE at 03:41Nmap scan report for 10.10.11.174Host is up, received echo-reply ttl 127 (0.100s latency).Scanned at 2025-06-13 03:41:34 EDT for 56sPORT STATE SERVICE REASON VERSION53/tcp open ...