search
inHTBTHM
githubEdit

Voleur

hashtag
Box Info

OS
Difficulty

Windows

Medium

As is common in real life Windows pentests, you will start the Voleur box with credentials for the following account: ryan.naylor / HollowOct31Nyt

hashtag
Nmap

┌──(irix㉿irix)-[~/Machines/Voleur]
└─$ nmap -Pn -T4 -A 10.10.11.76
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-18 13:58 UTC
Nmap scan report for 10.10.11.76
Host is up (0.42s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-08-18 21:59:12Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
2222/tcp open  ssh           OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
|_  256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012 (88%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2
Aggressive OS guesses: Microsoft Windows Server 2022 (88%), Microsoft Windows Server 2012 R2 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-08-18T21:59:44
|_  start_date: N/A
|_clock-skew: 7h59m59s

hashtag
Credential Hunt

first we will edit our hour like DC

then we start to use tools like smbmap, smbclient, crackmapexec but we get more errors

after search we found tool call NextExecarrow-up-right

then we use smbclient again but with shared folder but more error occur so we discover this tools not stable for this version of SMB protocol

Start to crate TGT for ryan.naylor

Access on SMB server using TGT

after download it and try to open this excel sheet we found it need password

image.png

Crack password

we found 3 users but one of them is deleted

Start bloodhound using svc_ldap credential

hashtag
0x1 Exploit WriteSPN

Generate TGT for svc_ldap user

Crack svc_winrm hash

Generate TGT to can access svc_winrm machine

hashtag
0x2 SVC_WINRM Shell

hashtag
0x3 Restore user(Todd.Wolfe)

we will try to get shell with svc_ldap account on DC machine

upload Runas script

take a shell on attacker machine

we know svc_ldap in group call Restore_user

and we know from SMB finding here is user call todd.wolfe is removed

let’s check it and try to restore it

restore deleted user

hashtag
0x4 DPAPI

DPAPI, or Data Protection API, is a cryptographic API built into Windows operating systems (2000 and later) that allows developers to encrypt and decrypt data using information from the user's account or the computer. It simplifies data protection by handling the underlying encryption without requiring explicit key management

Follow this arrticles

https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secretsarrow-up-right

Generate TGT

SMBclinet

Use dpapi.py decrypt the master key (file in C:\Users$USER\AppData\Roaming\Microsoft\Protect$SUID$GUID)

Decrypted the protect data (file in C:\Users$USER\AppData\Roaming\Microsoft\Credentials)

hashtag
0x5 Shell as svc_backup

Generate TGT and sign in we found Notes file and ssh key

Display Notes file and edit permission for ssh key

From nmap we know ssh running on port 2222

hashtag
Privilege Escalation

hashtag
0x6 Shell as Administrator

All C disk files in /mnt

Download Security and System files

and Download AD Folder

Use secretdump to dump hashes

Generate TGT to loged with Admin Acc

hashtag
0x7 Root Flag

PreviousERANextExpressway

Last updated