Support

Overview

Support is an Easy-difficulty Windows Active Directory machine. The path to user is a credential-hunting exercise: an anonymously readable SMB share hosts a custom .NET tool that queries the domain’s LDAP server, and the bind password it uses is hardcoded behind weak XOR obfuscation. Recovering that password lets us enumerate LDAP, where a user’s info attribute leaks a cleartext password. That user is in Remote Management Users, so it logs straight in over WinRM. This post covers recon through the user flag.

Machine Matrix

Custom-effort foothold: reversing a .NET binary to recover an XOR-obfuscated LDAP bind password, then a classic info-attribute cred leak; realistic AD cred-hunting with no CVE, modest enumeration.

Recon

nmap -sC -sV -Pn -p- 10.10.11.174

Port	Service	Notes
53/tcp	DNS	Simple DNS Plus
88/tcp	Kerberos	server time leak
389/636/3268/tcp	LDAP / LDAPS	Domain: support.htb
445/tcp	SMB	Windows shares
5985/tcp	WinRM	Microsoft HTTPAPI

The spread of ports (Kerberos, LDAP, SMB, WinRM) marks this as a domain controller for support.htb. There is no web server, so SMB is the obvious first stop. Add the hostname:

echo '10.10.11.174 support.htb dc.support.htb' | sudo tee -a /etc/hosts

Enumeration

List the SMB shares anonymously:

smbclient -L \\\\10.10.11.174\\ -N

Alongside the defaults there is a non-default share, support-tools (“support staff tools”). Connecting to it anonymously and listing the contents shows a set of off-the-shelf installers (PuTTY, Wireshark, 7-Zip) and one file that does not belong: UserInfo.exe.zip.

smbclient \\\\10.10.11.174\\support-tools -N -c "get UserInfo.exe.zip /tmp/UserInfo.exe.zip"
unzip /tmp/UserInfo.exe.zip -d /tmp/userinfo
file /tmp/userinfo/UserInfo.exe

The archive unpacks UserInfo.exe plus a pile of .NET DLLs, and file confirms a Mono/.Net PE32 assembly. .NET compiles to IL that decompiles almost back to source, so we can read exactly what the tool does.

Decompiling with a cross-platform ILSpy build reveals an LdapQuery() method that connects to LDAP://support.htb as support\ldap, pulling the password from Protected.getPassword(). That method holds a Base64 blob and “decrypts” it by XORing each byte with a rolling key (armando) and then with a fixed byte 0xDF:

private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
private static byte[] key = Encoding.ASCII.GetBytes("armando");
// for each byte: array[i] ^ key[i % key.Length] ^ 0xDF

XOR with a known key shipped in the same binary is not encryption. Reproduce the routine in a one-liner:

python3 -c "import base64; from itertools import cycle; enc=base64.b64decode('0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E'); key=b'armando'; print(''.join(chr(e^k^223) for e,k in zip(enc,cycle(key))))"

This prints the cleartext bind password for [email protected]. (As a sanity check you can also run the binary under Wine while capturing tun0 in WireShark — the LDAP bindRequest packet shows the same password in the clear.)

Foothold

With the ldap bind credential, query the directory and pull user objects together with the often-abused info attribute:

ldapsearch -x -H ldap://support.htb -D '[email protected]' -w '[redacted]' \
  -b "dc=support,dc=htb" "(objectClass=user)" sAMAccountName info memberOf

One account stands out: support. Its info attribute contains what is clearly a password ([redacted]), and its memberOf list includes Remote Management Users — the group that grants WinRM access. The info/Notes field is readable by any authenticated user and is a classic place admins stash secrets.

That single attribute is enough to log in. Use the leaked password over WinRM:

evil-winrm -u support -p '[redacted]' -i support.htb

User flag

*Evil-WinRM* PS C:\Users\support\Documents> type C:\Users\Support\Desktop\user.txt
[redacted]

We have an interactive shell as support and the user flag.

Privilege escalation — abusing GenericAll on the DC via a Resource-Based Constrained Delegation attack — is left as an exercise; this post stops at user.

Find more on Patreon