HackTheBox - Garfield

By Ippsec2 min readPublished 7 November 2026

Internal Read means the full piece stays on Qubicweb, with its source path and context still visible.

Brief points

00:00 - Introduction 01:01 - Start of nmap, noting port 2179 (vmrdp) means Hyper-V VMs are likely running behind this host 02:54 - This is an assumed breach box, running RustHou...

00:00 - Introduction 01:01 - Start of nmap, noting port 2179 (vmrdp) means Hyper-V VMs are likely running behind this host 02:54 - This is an assumed breach box, running RustHound-CE with the j.arbuckle creds and checking SMB shares with NetExec 04:46 - Dumping users over LDAP and seeing two krbtgt accounts, which tells us there is a Read-Only Domain Controller (RODC) 06:33 - BloodHound shows j.arbuckle has no outbound control, but l.wilson can force change the password of l.wilson_adm 07:39 - Using bloodyAD get writable with --detail to find we can write the scriptPath of most users, something BloodHound does not show 09:03 - Using dacledit to read the DACL and confirm the IT Support group is what grants us write access to scriptPath 11:09 - Checking last logon times, then writing a logon script that resets l.wilson_adm's password and calls back to Responder with the username 14:18 - Wrapping the PowerShell in a bat file as an encoded command and uploading it to the SYSVOL scripts folder with smbclient 16:02 - Setting scriptPath on l.wilson and l.wilson_adm with bloodyAD, seeing it run, and logging in as l.wilson_adm with evil-winrm-py 17:14 - Finding RODC01, BloodHound shows l.wilson_adm is in Tier 1 with ForceChangePassword and WriteAccountRestrictions over it 19:00 - Uploading chisel to DC01 and setting up a SOCKS proxy so we can reach RODC01, showing we are not admin there yet 20:48 - Running bloodyAD get writable as l.wilson_adm and adding ourselves to the RODC Administrators group 22:59 - Setting the managedBy attribute of RODC01 to l.wilson_adm, which makes us a local administrator on the read-only DC 25:46 - Running secretsdump against RODC01, DRSUAPI fails so we use -use-vss to pull ntds.dit from a shadow copy and get the krbtgt_8245 hash 28:27 - Explaining the blank hashes, why we need a custom ticketer.py, and why we avoid Mimikatz and LSASS to get the AES key 29:53 - Showing the other path to admin on RODC01, Resource-Based Constrained Delegation with addcomputer.py, rbcd.py, and getST 33:07 - Syncing our clock, configuring Kerberos, and using the service ticket with psexec through proxychains to get Administrator on RODC01 34:36 - Looking at the krbtgt_8245 account and reading the SpecterOps post on RODC golden tickets and the Key List attack 37:09 - Grabbing ticketer.py from an open Impacket pull request and forging an RODC golden ticket with the RODC number 8245 and the domain SID 39:43 - Running secretsdump with the ticket, getting access denied until adding -k, then hitting a policy error that restricts DRS 42:38 - Looking at msDS-NeverRevealGroup and msDS-RevealOnDemandGroup on RODC01, and clearing the never reveal list with bloodyAD 44:22 - Adding Users and Domain Controllers to msDS-RevealOnDemandGroup, but secretsdump still fails 49:07 - Adding Domain Admins to the reveal on demand list, secretsdump finally works, and we log into DC01 as Administrator

HackTheBox - Garfield

By Ippsec2 min readPublished 7 November 2026

Browse sourceIppsec

Internal Read means the full piece stays on Qubicweb, with its source path and context still visible.

Brief points

00:00 - Introduction 01:01 - Start of nmap, noting port 2179 (vmrdp) means Hyper-V VMs are likely running behind this host 02:54 - This is an assumed breach box, running RustHou...