Video summary

HackTheBox | Support [OSCP Style] (TWITCH LIVE)

Main summary

Key takeaways

Technology

Technological walkthrough (OSCP-style / HackTheBox live)

The speaker performs an end-to-end Active Directory compromise against a Windows domain controller (HackTheBox “Support”-themed content), using a structured workflow: recon → service enumeration → credential discovery → privilege escalation → AD abuse.

1) Setup & directory structure

  • Creates a working folder named Support.
  • Creates multiple subdirectories for workflow organization:
    • no
    • content
    • exploits
    • nmap

2) Reconnaissance

Determine host is up

  • Uses a fast ping-style check (ping, referenced as “pink” in subtitles).
  • Confirms the target responds: machine is online.

Identify OS (Windows vs Linux)

  • Infers OS via TTL heuristic:
    • TTL ~128 → likely Windows
    • TTL ~64 → likely Linux
  • Mentions alternatives:
    • A Python script utility that detects OS using a single probe with conditional logic.
    • Tips to place the script in a PATH-like directory (e.g., ~/.local/bin, local/bin) and ensure execution permissions.

3) Port scanning with Nmap (speed + parsing)

Full TCP scan optimized for speed

  • Runs Nmap TCP scan across all ports (65,535 total).
  • Uses speed optimizations:
    • --min-rate 5000 (subtitle mentions “mini rate of 5000 packets/sec”)
    • Mentions a faster “self-scan” / reset behavior from prior explanation
  • Uses nmap on-the-fly reporting behavior (referencing -sE): reports open ports during the scan.
  • Exports results to a grep-friendly output format for later filtering.

Parsing results

  • Saves the Nmap grepable output and uses regex-based filtering.
  • Uses a custom helper/cat-based function from their environment to render key open-port/service lines and copy ports into a notes/clip area.
  • Identifies key open ports (examples cited in subtitles):
    • 88 (Kerberos)
    • 389 (LDAP)
    • 445 (SMB)
    • 5985 (WinRM / HTTP)
    • plus additional hints around services like Age/SMB and other ports

4) Service/version enumeration

  • Performs a more thorough Nmap scan against the discovered ports to identify versions and services.
  • Then transitions into SMB/LDAP-oriented recon.

5) SMB enumeration (null session + share access)

Check network shares

  • Uses SMB enumeration tooling.
  • Mentions null session listing shared resources.
  • Finds an interesting share:
    • Support Tools (read-only)

Download and inspect share contents

  • Downloads/inspects content from the share directories.
  • Notably enumerates a content directory and observes .exe payloads.

6) Investigate a downloaded binary (userinfo.exe)

Static analysis steps

  • Downloads the user info.exe-related file and inspects it (with/without extraction).
  • Checks for:
    • Config files that might contain credentials (initially none in plaintext XML)
    • Uses strings to extract printable strings
    • Increases detail using an encoding/16-bit string decoding approach

Discover AD-related clues

  • Strings reveal:
    • LDAP/Active Directory query intent
    • Mentions of “password” usage (suggesting an authentication/crypto routine)
    • Domain/controller naming hints such as support.htb / “Support” domain concepts
  • Observes the binary’s logic for:
    • Querying AD (via LDAP)
    • Handling/deriving a credential internally (password-protection/decode steps)

7) Active Directory enumeration using discovered info

User validation brute force / dictionary

  • Uses a Kerberos/LDAP brute-like approach conceptually:
    • Validates which users exist via LDAP queries
  • Notes existence of a large user dictionary (millions).
  • Finds valid users such as:
    • ldab (explicitly referenced)
    • guest
    • and other “valid” users from brute validation

Kerberoasting discussion (but not fruitful here)

  • Explains Kerberos attacks:
    • AS-REP Roasting
    • Kerberoasting
  • For this machine, indicates Kerberoasting likely fails because no user is eligible (SPN/conditions aren’t set).

8) Dynamic analysis / make the binary work against the target

Why it failed initially

  • The binary expects to resolve support.htb.
  • Locally, name resolution fails until host mapping is corrected.

Fix: add hosts entry (Windows hosts file)

  • Updates C:\Windows\System32\drivers\etc\hosts via Notepad as admin.
  • Adds mappings like:
    • support.htb → target IP
    • dc.support.htb → target IP
  • After this, the binary can contact the target through VPN connectivity.

Runtime AD querying behavior

  • Uses the binary’s CLI options (e.g., find First/Last ...-style queries).
  • Extracts user attributes such as:
    • first name / last name
    • contact email
    • password last change
  • Tries wildcard/regex-like patterns to enumerate users.
  • Output shows usernames but not obvious plaintext passwords.

9) Reverse engineering: extract the real plaintext password

Decompile/analyze with a .NET decompiler

  • Uses a .NET analysis tool to inspect userinfo.exe at code level.
  • Finds:
    • A password-protected string
    • Logic for decoding/decrypting the password (base/endianness and transformations using keys/conditions)

Debugging to recover password at runtime

  • Sets a breakpoint inside the get password routine.
  • Steps execution until the plaintext password variable appears.
  • Extracts the resulting plaintext password (subtitles show it becomes a known candidate).

10) Credential testing & access via WinRM (Evil-WinRM)

Validate credential

  • Uses tools like crackmapexec / SMB/WinRM-style checks.
  • Confirms credentials work for a user (again: ldab and later a Support-style user context appear).

WinRM privilege check

  • Notes:
    • Port 5985 open enables WinRM.
  • Checks whether the user belongs to a privileged group that yields “Power” (admin-like rights).
  • If granted:
    • Connects with Evil-WinRM to obtain an interactive shell.

Actions after landing

  • From the shell:
    • Runs ipconfig / checks network identity
    • Attempts to read proof files:
      • user flag blocked due to permissions
      • but escalation later allows admin actions

11) Privilege escalation path with BloodHound + AD object abuse

Collect AD relationship data

  • Sets up Neo4j + BloodHound (latest versions mentioned).
  • Uses SharpHound (sharphound.exe) to collect:
    • sessions
    • ACLs
    • group memberships
    • and other AD graph data
  • Uploads the compressed dataset to BloodHound for graph analysis.

Identify abuse path

  • Finds an interesting group/object:
    • “shared Support account” group
  • BloodHound indicates members have:
    • GenericAll / FullControl-like rights over a target computer object

Perform RBCD (Resource-Based Constrained Delegation) attack

  • Uses AD abuse to modify computer object permissions for RBCD:
    • Creates a fake computer account in the domain via PowerShell (PowerView/PowerMath concept)
    • Retrieves computer SID
    • Configures resource-based delegation to allow impersonation to the target DC/computer
  • Subtitles mention the S4U / ticket generation flow, referencing Rubeus and also an automation alternative using Python for RBCD.

Impersonate admin with Kerberos ticket

  • Uses a pass-the-ticket / Kerberos cache method:
    • Sets a KRB5CCNAME-like environment variable (subtitle mentions krb c5 style naming)
  • Gains access using Kerberos-enabled tooling patterns (subtitles show a “cme/evil” style access approach).
  • Ultimately obtains administrator access and reads Root.txt.

Notable “review/guide/tutorial” style elements

The walkthrough repeatedly emphasizes “remember this” OSCP-style reminders, including:

  • Recon organization and directory layout
  • TTL-based OS fingerprinting
  • Nmap speed tuning + grepable output + regex filtering
  • SMB null session + share enumeration
  • Hosts-file fix for domain resolution
  • Binary analysis workflow:
    • strings → behavior understanding
    • .NET decompile
    • debugger breakpoint to recover plaintext credential
  • AD exploitation workflow:
    • BloodHound + SharpHound → permission misconfig discovery
    • RBCD → Kerberos ticket impersonation

Main speakers / sources

Main speaker

  • The HackTheBox/Twitch live streamer/host running the walkthrough (no specific name shown in subtitles).

Referenced tools/sources

  • HackTricks (Kerberos enumeration guidance)
  • inforecmachines.io (Kerberos/golden ticket references)
  • BloodHound / SharpHound
  • Evil-WinRM
  • nmap
  • crackmapexec
  • PowerView / PowerMath
  • Neo4j
  • Kerberos tooling (e.g., Rubeus mentioned)

Original video