HackTheBox - Checkpoint

By Ippsec1 min readPublished 24 October 2026

Internal Read means the full piece stays on Qubicweb, with its source path and context still visible.

Brief points

00:00 - Introduction 00:52 - Start of nmap 02:25 - Authenticating as alex.turner with NetExec (this is an assumed breach box), listing the domain users and noticing several acco...
We only have read access for now 05:32 - Collecting BloodHound data with RustHound-CE, then using bloodyAD get writable to find write access over the Deleted Objects container a...
is the help desk default) and seeing that this account now has write access to the DevDrop share 17:22 - Building a malicious VS Code extension with yo code, pasting in a Node r...

00:00 - Introduction 00:52 - Start of nmap 02:25 - Authenticating as alex.turner with NetExec (this is an assumed breach box), listing the domain users and noticing several accounts had their passwords set around the same time 04:10 - Enumerating SMB shares and finding DevDrop, a share for approved VS Code extensions. We only have read access for now 05:32 - Collecting BloodHound data with RustHound-CE, then using bloodyAD get writable to find write access over the Deleted Objects container and GenericWrite over a deleted user, mark.davies 11:52 - Using the NetExec tombstone module to list the deleted mark.davies account and restore it out of the AD Recycle Bin 14:35 - Logging in as mark.davies through password reuse (Checkpoint2024! is the help desk default) and seeing that this account now has write access to the DevDrop share 17:22 - Building a malicious VS Code extension with yo code, pasting in a Node reverse shell, and packaging it to a vsix while setting the engine to 1.118.0 to match the share 26:30 - Adding the onStartupFinished activation event so the extension runs when VS Code opens, swapping sh for cmd.exe, uploading to DevDrop and catching a shell as ryan.brooks 30:38 - BloodHound shows ryan.brooks has GenericWrite over svc_deploy; grabbing a TGT with Rubeus tgtdeleg and converting it to a ccache so we can run bloodyAD 35:10 - Explaining dMSA and the BetterSuccessor technique (BadSuccessor itself is patched on Server 2025), then running bloodyAD add badSuccessor to dump svc_deploy's NTLM hash 39:25 - Authenticating as svc_deploy and reading the VMBackups share, which holds huge VMware files that would take forever to exfil 41:10 - Running vmkatz on the box against the VM memory snapshot to pull the local Administrator NTLM hash without downloading the backups 44:33 - Reusing that hash for the domain Administrator over evil-winrm and grabbing the user and root flags

HackTheBox - Checkpoint

By Ippsec1 min readPublished 24 October 2026

Browse sourceIppsec

Internal Read means the full piece stays on Qubicweb, with its source path and context still visible.

Brief points

00:00 - Introduction 00:52 - Start of nmap 02:25 - Authenticating as alex.turner with NetExec (this is an assumed breach box), listing the domain users and noticing several acco...
We only have read access for now 05:32 - Collecting BloodHound data with RustHound-CE, then using bloodyAD get writable to find write access over the Deleted Objects container a...
is the help desk default) and seeing that this account now has write access to the DevDrop share 17:22 - Building a malicious VS Code extension with yo code, pasting in a Node r...