Pirate

Technical Walkthrough

Pirate Walkthrough

Current State

Phase A is complete per user-provided handoff. Raw Phase A command artifacts are not yet synced into this local folder, so notes currently distinguish the values as a handoff state.

Expected Path To Validate

1. Enumerate DC01 and confirm pirate.htb.
2. Validate starting credential pentest:p3nt3st2025!&.
3. Handle Kerberos time skew.
4. Enumerate AD and collect BloodHound data.
5. Abuse Pre-Windows 2000 machine account behavior for MS01$.
6. Use MS01$ to read gMSA <password redacted>.
7. WinRM to DC01 as gMSA.
8. Discover and pivot to internal WEB01. Current validated internal addresses: DC01 <TARGET>, WEB01 <TARGET>.
9. Abuse NTLM relay/RBCD to get Administrator-equivalent access on WEB01.
10. Capture user flag on WEB01.
11. Dump a.white credential from WEB01.
12. Use a.white / a.white_adm WriteSPN and constrained delegation path.
13. Get SYSTEM on DC01 and capture root flag.

Phase B Pivot Plan

Preferred: Ligolo-ng, because Pirate requires several follow-on tools to reach WEB01 and a route-style pivot is easier to reason about than SOCKS-only state.

1. Start Ligolo proxy on Pwnbox in a persistent tmux pane.
2. Upload Ligolo agent to DC01 using the gMSA WinRM foothold.
3. Start the agent from DC01 back to Pwnbox.
4. Add a route for <TARGET>/24 through the Ligolo interface.
5. Validate from Pwnbox:

- ping may not work; do not depend on it.

- Use TCP checks against WEB01.

- Confirm 445/tcp and then broader Windows service ports.

1. Save all route, listener, and scan output under enum/ and nmap/.

Success criteria for Phase B:

• A persistent tunnel is running.
• Pwnbox tools can reach <TARGET>:445.
• WEB01 hostname/IP mapping is recorded.
• WEB01 SMB signing state is checked and saved.
• The team is ready to run ntlmrelayx and coercion in separate persistent panes for Phase C.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Target: Pirate
• Difficulty: Hard
• OS: Windows
• Created / released: 2026-02-28
• Current known IP: Pending in local notes; user-reported Phase A live state confirms DC01 and internal WEB01.
• Local support folder: <local workspace>

Evidence Rule

Public research in research.md is advisory only. Record only live target evidence in this file after validation.

Evidence Ledger

Validated Phase A State

Phase B Objective

Establish a reliable pivot from Pwnbox through DC01 to <TARGET>/24, then validate WEB01 SMB/RPC reachability from Pwnbox tooling.

Attack Map

Hosts

Services

Credentials

Attack Paths

Trust Edges (Confirmed)

pentest --smb/ldap--> DC01
MS01$ --gMSA-read--> gMSA_ADFS_prod$, gMSA_ADCS_prod$
gMSA_ADFS_prod$ --winrm--> DC01 (PowerShell only, no cmd)
gMSA_ADFS_prod$ --winrm--> WEB01 (non-admin, Remote Management Users)
gMSA_ADCS_prod$ --winrm--> DC01 (PowerShell only, no cmd)
DC01 [<TARGET>] --switch01--> WEB01 [<TARGET>]
WEB01 [<TARGET>] --direct--> Pwnbox [<TARGET>] (confirmed ports 445, 8000, 8081)
LVVFWLGX$ --RBCD/S4U--> Administrator@WEB01 (cifs/WEB01.pirate.htb)
a.white --smb--> DC01 (valid, no WinRM)
IT group (a.white_adm) --WriteSPN--> DC01$, MS01$, EXCH01$, WEB01$

BloodHound Key Data

• 4 computers: DC01, WEB01, MS01, EXCH01
• 10 users, 54 groups
• DC01: Unconstrained Delegation
• WEB01: Constrained delegation (HTTP/WEB01, WSMAN/WEB01, HOST/WEB01.pirate.htb)
• Domain Secure Servers: MS01$ (gMSA read privilege)
• IT group: a.white_adm (WriteSPN on all computer objects)

Notes

NTLM Relay Configuration

• Target: ldaps://<TARGET>
• Flags: --delegate-access --remove-mic -smb2support
• Coercion: coercer against WEB01 using gMSA creds

S4U Ticket Parameters

• First S4U: cifs/WEB01.pirate.htb impersonate Administrator
• Root S4U: HTTP/WEB01.pirate.htb with -altservice CIFS/DC01.pirate.htb

SPN Changes

• Remove HTTP/WEB01 from WEB01$ (if present)
• Add HTTP/WEB01 to DC01$ (or as needed per live BloodHound)

Dead Ends

VPN Mismatch - Starting Point vs Labs

• Hypothesis: Target at <TARGET> should be reachable from Pwnbox
• Tested: nmap -Pn -sT multiple ports, traceroute, direct TCP connect on 445
• Why it failed: Pwnbox is on Starting Point VPN (edge-us-starting-point-vip-1-dhcp), Pirate is on Labs network
• Tried: Changed VPN endpoint to edge-us-free-1.hackthebox.eu - VPN auth failed (certs tied to SP)
• Revisit if: User spawns Pirate and provides Labs VPN config, or respawns Pwnbox with Labs VPN

Notes

Target: <TARGET> (DC01.pirate.htb)

Domain: pirate.htb

Difficulty: Hard

Started: 2026-05-05

Phase A Completed: 2026-05-06 06:31 UTC

Attacker IP: <TARGET>

Pwnbox: <TARGET> (<<secret redacted>>)

Workspace (Pwnbox): /home/<<secret redacted>>/pirate/

Phase A Evidence Ledger

Credentials Collected

pentest : p3nt3st2025!&                              [SMB, LDAP]
MS01$   : <REDACTED>, LDAP - Domain Secure Servers]
EXCH01$ : <REDACTED>, Kerberos]
gMSA_ADFS_prod$ NTLM: <<secret redacted>>  [WinRM DC01]
gMSA_ADCS_prod$ NTLM: <<secret redacted>>  [WinRM DC01]

Network Map

[Pwnbox <TARGET>] ──VPN──> [DC01 <TARGET>]
                                    │
                               [<TARGET>/24]
                                    │ (Hyper-V vEthernet Switch01)
                                    │
                               [<TARGET> WEB01]

Tools & Versions Used

• nmap 7.94SVN
• nxc (netexec) latest
• bloodhound-python (legacy 4.2/4.3 format)
• impacket 0.14.0.dev0+20260505
• bloodyAD 2.5.4

Key Notes

• gMSA WinRM shell is PowerShell only (cmd fails with "no Invoke rights")
• Use -X flag for PowerShell, not -x for cmd
• MS01$ password was already changed by another player to <password redacted> (min password age blocks re-change)
• EXCH01$ was in <secret redacted> state - changed via changepasswd.py rpc-samr
• Only MS01$ can read gMSA <password redacted> (member of "Domain Secure Servers")

Phase B Evidence Ledger (Pivot to WEB01)

Phase C Evidence Ledger (RBCD Relay + User Flag)

Phase D Evidence Ledger (Root Flag)

Final Results

• User flag: <REDACTED>, C: <REDACTED>
• Root flag: <REDACTED>, C: <REDACTED>
• Engagement: COMPLETE

Session Resume

Last updated: 2026-05-05 (<secret redacted> COMPLETE - All flags captured)

Current Access

• DC01 (<TARGET>): WinRM as gMSA_ADFS_prod$ (non-admin on DC01)
• WEB01 (<TARGET>): Administrator via S4U Kerberos ticket (LVVFWLGX$ RBCD)
• a.white credentials confirmed: E2nvAOKSz5Xz2MJu (SMB on DC01, no WinRM)

Network Status

• Pwnbox: <TARGET> (VPN IP: <TARGET>)
• Chisel tunnel: ACTIVE (Pwnbox:8081 server, DC01 client, SOCKS on <TARGET>:1080)
• WEB01 reachable via SOCKS proxy (proxychains or PySocks)
• ntlmrelayx was used and target consumed (relay completed)

Active Sessions / Tunnels

• tmux session: pirate with windows: main, staging, chisel, recon, relay, coerce
• Chisel SOCKS proxy on Pwnbox port 1080
• Kerberos ticket: /home/<<secret redacted>>/Administrator.ccache (cifs/WEB01.pirate.htb, valid ~10hrs)

Flags

• User flag: <REDACTED>
• Root flag: <REDACTED>

Phase C Results

• Created machine account: LVVFWLGX$ / w1axqm4eEeJ+R via RBCD relay
• PrinterBug triggered from WEB01 to Pwnbox (custom PySocks script)
• S4U ticket obtained for Administrator@cifs/WEB01.pirate.htb
• Secrets dumped from WEB01: <REDACTED>

Key Credentials for Phase D

• `a.white : <REDACTED>, needed for password reset of a.white_adm)
• a.white_adm (member of IT group, has WriteSPN on all computer objects)
• WEB01$ has constrained delegation: HTTP/WEB01, WSMAN/WEB01, HOST/WEB01.pirate.htb

Phase D Execution Summary

1. Reset a.white_adm password via bloodyAD (a.white -> a.white_adm)
2. Removed HTTP/WEB01 SPN from WEB01$, added to DC01$ (via addspn.py from krbrelayx)
3. Used getST.py with S4U2Self+S4U2Proxy and -altservice to get CIFS/DC01.pirate.htb ticket as Administrator
4. wmiexec as pirate\administrator on DC01 -> root.txt captured
5. SPNs restored to original state (cleanup)

Status

• <secret redacted> COMPLETE. All objectives achieved.
• Both flags submitted.

Technical Notes

• impacket through proxychains times out on SMB (known SOCKS5 issue)
• PySocks monkeypatch (socket.socket = socks.socksocket) works perfectly with impacket
• Script at /tmp/printerbug_socks.py (PrinterBug via PySocks)
• Script at /tmp/get_flag.py and /tmp/secretsdump2.py (SMB access via PySocks)
• smbclient (Samba) works through proxychains; impacket does not

Cleanup Notes

• krb5.conf on Pwnbox modified to <secret redacted> realm
• /etc/hosts on Pwnbox: DC01.pirate.htb, WEB01.pirate.htb, MS01.pirate.htb entries added
• Machine account LVVFWLGX$ created in domain (CN=Computers,DC=pirate,DC=htb)
• RBCD delegation set on WEB01$ msDS-AllowedToActOnBehalfOfOtherIdentity